core package

Package core is the platform's immutable ledger (design §2.5.2): every collection, its official grc721 token and royalty, its provenance (commit–reveal v2), the engine registry, fees and the admin timelock.

What core guarantees, whoever holds the admin key:

• I-1 admin cannot move, approve or burn a token, and holds no funds; the op list is a closed set of parameters (admin.gno).
• I-2 pause only gates create, mint and trade. Transfer, burn, finalize, distribute and every cancel stay open, and a pause expires by itself after MaxPauseBlocks.
• I-5 supply only grows through the collection's bound minter, never past maxSupply, and a token id is never minted twice.
• I-6 after Launch the engine, params, supply, payees, sale window and commitments are frozen.
• I-10/11 a collection becomes Final at most once, only with both reveals or after revealDeadline, and that deadline is bounded, so the pre-reveal transfer lock always ends.
• I-12 engine code never runs on a state-changing path, except the creator's own CreateCollection (ValidateParams) and the engine's own RegisterEngine (one sample render). Every exported non-crossing function is read-only, so an engine cannot call back into a mutator.
• I-13 every stored string passed safe.AssertText.

core imports no mutable realm: minters and engines are known only by package path and interface value.