hollowmere/v1 package

Package hollowmere is the on-chain slice of Book One, "The Three Ember Seeds" -- the adventure's own chain record, separate from garden/v2's pet-care record, per the owner's ask: "the adventure game needs chain features."

Authored and tested without gnokey or any key material, per this assignment's own brief. Whether and when this package has actually been deployed is deliberately not asserted here: this comment ships on chain exactly as written the moment it is deployed, and a realm cannot be edited afterwards, so a "not deployed yet" sentence here would go permanently stale at the exact moment it stopped being true -- see garden/v2/gnomod.toml's own history for why this is a real failure mode, not a hypothetical one. Deploy status belongs in DECISIONS.md and STATUS.md, which can still be edited after the fact.

============================================================================ THE HONESTY PROBLEM THIS PACKAGE EXISTS INSIDE -- READ THIS FIRST ============================================================================

The adventure's levels run in the browser. This chain cannot watch a player solve the rune-rhyme puzzle, bonk the Great Mothkin three times, or do anything else Book One's plan describes -- it can only watch a wallet sign a transaction that ASSERTS those things happened. The plan itself says this plainly: "the levels run in the browser, so a determined cheat can poke at them" (pack-update/01-adventure-plan/book-one-plan.md, "Risks and decisions for Seán").

So this package is commented, named and worded throughout to make that limit impossible to miss -- carried by the comments, the event name, the type names and Render's own wording, not by any single exported function's name in isolation (a player signing ClearChapter(1, 1) in a wallet sees that call and nothing else; the honesty framing has to already live in the surrounding names and docs, because there is no comment attached to a signing prompt):

• ClearChapter does not "verify" or "check" a clear. It records a CLAIM: this address says it cleared this chapter, and the chain stamps that claim with the block's own timestamp. Nothing here replays a puzzle, checks an input log, or asks the browser for proof of anything. The function's own comment says so; the bare function name a wallet shows does not carry this by itself.
• bookOneClaim, the storage type, and claims, the tree that holds it, are named for what they are: a ledger of claims, not a record of verified outcomes.
• The emitted event is named ChapterClaimed, not ChapterCleared or ChapterVerified.
• Render's own wording repeats this to the one audience who will actually read it: a player looking at their own public page.

What this DOES genuinely give the game, worth having even though it is not refereed: the record is public, permanent, timestamped by the chain rather than the client, tied to a wallet rather than a browser's local storage, and readable by anyone without trusting gnotchi.com's server to tell the truth. For a cosy single-player adventure with nothing to win from another player's loss, that is a sound trade. See NOTES.md for the full writeup of why the owner's narrower ask (chapter purchase, the daily burrow, players' notes) is deliberately NOT built here, rather than half-built to look more complete than it is.

============================================================================ SCOPE -- what this package is, and deliberately is not ============================================================================

Built: chapter-completion claims (ClearChapter), Ember Seeds derived from those claims (never accepted as an input), a per-address progress read (BookOneClaim), and a public Render page.

NOT built, on purpose, not half-built: chapter purchase (nothing is for sale here; this package handles no money at all, enforced the same way garden/v2 does, below), the daily burrow and its leaderboard (needs a dungeon generator that doesn't exist yet), and players' notes (stored free text on a permanent public page re-opens the hostile-name problem garden/garden.gno's own NOTES.md already has open, and deserves its own design pass rather than a rushed one here). See NOTES.md for the full reasoning on each.

============================================================================ WHY THIS NEVER CALLS recover() ============================================================================

This package calls no grc721 ledger, mints nothing, and has no transfer hook to protect -- the specific recover()-undoes-a-soulbound-guarantee trap garden/garden.gno's own SECURITY note documents does not literally apply here, because there is no ledger write to re-expose. But the underlying reason not to recover() is the same one stated above in different words: this package's entire credibility is "the chain only ever records a claim that fully passed every check in ClearChapter below." Every mutating path in this file validates completely BEFORE touching any stored claim (see ClearChapter's own comment for the exact validate-then-commit sequence), so an uncaught panic already guarantees the Gno/Cosmos SDK transaction boundary discards the whole failed call with no partial claim ever written. A recover() anywhere in this file -- even one added later for an unrelated reason -- could let a claim that failed a check halfway through land anyway, which is exactly the "the chain checked something it didn't" impression this package's own doc above insists it must never give. Don't add one.