HARVEST COUNTY

Yield farming. Literally.

Whitepaper v1.0, August 2026

A competitive farming world where every player's true character is the AI they train to run their farm. Towns of a hundred farms share one living market; fortunes are made by growing, timing, forecasting, contracting, and occasionally betraying. Real money is won through skill, staked tournaments, agent authorship, and discovery royalties, never through emissions that later players must buy.

0. Abstract

Harvest County is a play-to-earn game built on a refusal: no player's earnings may ever depend on the arrival of the next player. Crypto gaming has repeatedly proven the demand for earn-while-you-play, with viral titles reaching six-figure player counts in days, and then proven the failure mode: losing 99% of value within months, because every "yield" was ultimately a claim on future players' deposits. Harvest County keeps what made those games spread (scarcity, shareable wins, the thrill of being early) and replaces the economic core with three honest engines: staked skill tournaments (the prize pool is the entry fees, redistributed by skill, minus a small rake), a creator economy for AI agents (players selling automation to players), and a fun-spending majority (cosmetics, passes) funding free prize pools. The game name is the thesis: crypto's "yield farming" made literal, and made sustainable.

1. Design philosophy

1.1 The governing identity

Player earnings = new-player deposits + external revenue − protocol take.

Every collapsed play-to-earn economy shares one trait: external revenue near zero, making player earnings definitionally later players' deposits. Harvest County's rule: every withdrawable dollar must trace to a dollar that entered from someone who wanted a product, a fun experience, a cosmetic, a knowingly placed tournament stake, or a useful AI agent. (The game is deliberately ad-free: no ad networks, no attention-selling, a premium-feel decision that also keeps the crypto-native audience, who run blockers and read ads as low quality.)

1.2 Four tests, applied to every mechanic

1. Source-of-funds test: does money enter from someone who wants the product, not a return?
2. Payback test: nothing sold may have a marketable payback period.
3. Sink test: every sink must fire independently of new-player onboarding.
4. Fun-floor test: if every crypto element vanished tonight, would people keep playing? The game must be fun enough that yes.

1.3 Design pillars

• Your AI is your character. Progression = your agent getting smarter. Attachment = your agent having a name, a memory, a voice.
• The game is a show. The farmhand is a visible character doing the work on screen, training your AI pays off as watchable behavior, not just numbers. If players love watching their farm run, retention follows.
• The market is the battlefield. No swords. PvP is supply wars, contract sniping, forecast duels, and cartel betrayals.
• Losing is curriculum. Every defeat generates a personalized lesson (missed-profit reports, winner replays).
• Money is honest. Every prize pool's funding source is published. Nobody is ever unknowingly the yield.

2. The world and the core loop

2.1 Clock and cadence

• 1 tick = 1 in-game hour = 1 real hour. A season ("Harvest") = 7 days = 168 ticks, short enough that a bad week never traps you, and every Monday is a fresh reason to return.
• Agents act every tick. Humans check in for minutes a day; two daily ritual windows, the Dawn Auction (contract board refresh, 8am local) and the Dusk Close (daily settlement + town digest, 8pm local), give humans an appointment without punishing absence.
• The month is the meta-arc: four weekly Harvests are one championship, scored by placement each week with your best three of four counting, and a share of protocol revenue accumulates into a monthly Championship Bounty behind it, paid out across the table in proportion to points when the month closes. Every week counts the same, the fourth included. Weekly seasons carry a rotating modifier, drawn from the season's own seed and announced before the week opens (Drought Week, Gold Rush, Locust Bloom, Glut, and most weeks plain, because a special week is only special against an ordinary baseline). A modifier reshapes the week for all hundred farms equally, out of levers the engine already has, so it changes what a good week looks like without changing who can win; it rides in the season's genesis, so a replay reproduces it; the hand-crafted meta-breaking Twist ships monthly with the Grand cycle, keeping the content treadmill affordable.

2.2 The town

• ~100 farms share one market, one weather system, one pest ecology, one government. Towns are spawned as cohorts (new players enter freshly-started newcomer towns, so nobody joins a race half-run) and sized elastically at low population, with house agents backfilling thin towns (always labeled as NPCs).
• You can see neighbors' fields, buildings, and cash, never their sheds. The trade tape (who sold what, when) is public. Town chat is built-in. Reputation is visible.
• The story layer is emergent by design: town rivalries, contract betrayals, locust-night defenses, and the weekly Season Chronicle turn every Harvest into serialized drama, with your farmhand as the protagonist you trained.

2.3 A day in the life (casual)

Open the app → your farmhand's overnight diary: "Watered everything. Sold 40 eggs at 52 before the dip. Held wool, Yarn Store opens tomorrow. ⚠️ Farm 17 is planting a LOT of melons." → approve today's plan or tweak one rule → check the Dawn Auction (a bakery contract: 200 wheat by Friday, 15% over spot, worth committing?) → vote yes on the town irrigation project → open your daily seed pack → done in five minutes. Your agent handles the other 23 hours.

The loop in one sentence: plant and tend (action) → sell into a live shared market (feedback) → reinvest in land, buildings, strains, and better doctrine (progression), repeated 168 ticks a week, mostly by your agent, with your daily minutes reserved for the highest-leverage calls.

2.4 A week in the life (one Harvest)

• Days 1–2, Land Rush. Clear, plant, build; strains re-bred from blueprints (holders get a fast head start); town elects a tax rate; cheap contracts.
• Days 3–4, The Squeeze. Town demand ramps 2×; first pest waves; the midweek Town Cup (town vs town).
• Days 5–6, High Season. Demand 3×; caravans open (inter-town arbitrage); contract board runs hot; the weather front breaks.
• Day 7, The Reckoning. Demand 4×; contracts come due (or default); the final-hours Harvest Frenzy with leaderboard swings every tick; unsold inventory is worthless at the bell.
• Then: prizes settle overnight, the Season Chronicle (auto-cut highlight reel of your town's drama) publishes, soft reset, and Monday's modifier is announced. The fourth week of a month is an ordinary week that happens to be the last one: it scores like any other, and the championship table settles on the month's accumulated points once it is done.

2.5 What persists across seasons

Rating, cosmetics and homestead, farmhand (memory, skills, personality), doctrine cards and Workshop listings, strain blueprints (see §3.3). What resets weekly: coins, fields, buildings, market state. Veterans feel rich in capability and identity, never in compounding in-season resources, that's how late joiners always have a fair race.

2.6 The Homestead: everyone's first farm (and forever sandbox)

Every player starts with a Homestead: a downsized personal farm (6×6, no quadrant unlocks) running the exact competition ruleset, same crops, care taxes, contracts-lite, and a real market, but with no modifiers and no stakes. The market it trades into is a ghost market: a deterministic replay of a real town's actual week, so prices move for real reasons and lessons transfer 1:1 to competition. Three jobs: - On-ramp: this is where minute-one begins, Pip is hired here, dials and doctrine are learned here, the learn-to-earn quests live here. You enter your first freeroll only after your Homestead has run a full practice week. - Forever sandbox: the Homestead never goes away. Test a new doctrine against last week's ghost market before deploying it in a bracket; veterans use it as a live testbed, returners use it to knock off rust risk-free. - The County Fair: because every Homestead faces the same ghost week, a global leaderboard is a pure skill comparison, no modifiers, no matchmaking, no stakes, just "who ran the best farm under identical conditions." Weekly Blue Ribbons (cosmetic flair, hall-of-fame entry) are pure bragging rights: no cash at all (sybil-proof by having nothing to strip-mine), and a surprisingly sharp signal, Fair rank is the cleanest public proof of skill in the game, and a natural scouting ground for town invitations.

2.7 Daily play: streaks and the human edge

The agent runs the farm; the human's daily minutes are made precious two ways: - Streak rituals: consecutive-day check-ins earn seed packs, Focus top-ups, and cosmetic shards, soft rewards only, never cash (login money attracts click-farmers; placement money stays placement-only). Streaks bend, not break: one missed day costs a tier, not the streak. - The human edge (bounded): a menu of daily manual actions that beat the agent's autopilot by design, a perfectly-timed manual harvest (+10% on that plot), sniping the Night Market yourself, haggling a contract in a short negotiation exchange, hand-scouting a neighbor's fields, entering the day's forecast. Each is capped per day and the total manual edge is bounded (~10–15%) so touching the game daily matters without making AFK play unviable or turning staked brackets into grind contests.

3. Game systems

3.1 Land and soil

Farms are 12×12 grids with quadrant unlocks (coin sink). Tiles differ: loam (balanced), clay (water-retentive, forgiving), sand (fast-draining, high risk/yield with irrigation), riverbank (self-watering, scarce), rocky (build sites). Farm layout is a placement puzzle; two farms are never identical, so copied strategies still need local adaptation.

3.2 Crops and livestock

• Staples → exotics: wheat (cheap, stable, feeds animals) → carrot, tomato (repeat-harvest) → strawberry, melon (premium, price-fragile) → seasonal exotic (each monthly Twist introduces one, e.g. saffron: tiny yields, enormous price, brutal care schedule).
• Care or consequences: unwatered crops weed out in 2 days; unfed animals escape; both feed the pest ecology (§3.5). The attention tax is the reason automation is the product.
• Livestock as capital: coop/pasture buildings; goose→eggs, cow→milk, sheep→wool; fed daily with wheat; produce indefinitely; yield fertilizer. Animals are the "bond ladder" to crops' "options book."

3.3 Strain genetics and the Almanac (original system #1)

Every crop carries a simple genome: yield / hardiness / quality / quirk (e.g. "night-bloomer: waterable at dusk", "pest-bitter: repels weevils", "market-darling: +10% at bakeries"). Cross-pollinate adjacent plots to breed; rare mutations appear through volume and variety of experimentation. - Discovery: breed a genome nobody has registered → name it, register it in the Town Almanac (then the World Almanac). "The Reyes Melon" is permanent, with your name on it. Discovery is the deepest status hook in the game. - Blueprints: a discovered strain's blueprint persists across seasons as a collectible. It must be re-bred each week from base stock, a fast, near-automatic process for blueprint holders (~1 day head start, not a handicap on others), keeping weekly seasons fair while making discovery permanent wealth. - Strain economy: blueprint licenses sell in the Workshop; the breeder earns royalties every time. Players selling productive discoveries to players: earning that passes the source-of-funds test, and a second creator economy alongside agents.

3.4 Weather and the Forecast Duel (original system #2)

Weekly weather fronts (heat, storm, drought, perfect week) modify water needs and yields, town-wide. Fronts are forecastable with skill: pressure/humidity indicators leak signal days ahead. - The Almanac Forecast is a daily prediction mini-game (rain or shine? melon price above 90 by Friday?). Good forecasters earn Focus, cosmetics, and a town-visible Forecaster rating, a way to be famous and useful without farming skill, and a data-nerd on-ramp. - Weather is shared town-RNG: it never targets an individual, and skilled agents hedge it (clay tiles, hardy strains, irrigation), so RNG creates stories, not injustice.

3.5 Pests and externalities (original system #3)

Neglect is contagious: weeds and unfed-animal messes generate pest pressure that spills onto adjacent farms in the town map. Locust events threaten whole quadrants of a town and are repelled only by collective spending from the town treasury or coordinated care actions. - This makes your neighbor's diligence your business, the social glue of shame, gratitude, and "we defended the east fields together at 2am" war stories. - Griefing bound: pests damage yield, never destroy buildings/animals/strains; a lazy neighbor costs you percentage points, not your farm.

3.6 The Contract Board (original system #4: the drama engine)

Spot selling is half the market. The other half is the Dawn Auction contract board: - NPC forwards: shops post contracts, 200 wheat by day 19 @ spot+15%, first-come or sealed-bid. Locked prices reward planning and hedge the volatile spot market. - Player-to-player forwards: any player can write a contract (deliver/receive goods at a future date and price), collateralized in coins, taken by any town neighbor. - A forward is a promise, not an option. At the due hour the shed delivers whatever it holds, up to the quantity, and is paid the contract price for it, with the collateral returned in proportion. Whatever fails to arrive, the buyer replaces at the going rate and bills the difference to the farmer who promised it, and a broken-word fine on the value of the shortfall is taken the same hour. That bill can push a till into the red, deliberately: a penalty capped at whatever happens to be in the purse would be dodged by spending the purse first, and a farm in the red can neither plant, buy, expand nor promise anything until it has sold its way back to solvent. That is what stops a contract being a cheap option on your own crop: delivering beats breaking your word at every price, so there is no spike worth waiting for. Growing 90% of an order is paid for as 90% of an order, and a shortfall while the price is flat or falling owes no replacement cost at all, so the rule is gentler on the farmer whose crop failed and harder only on the one who sold the goods out from under the promise. - Scars are a price, not a badge. Every default is a permanent, public reputation scar that carries across seasons. Each one raises the collateral the board asks of you on every later contract, up to a promise backed pound for pound, and multiplies the fine on your next broken word. The two work at different speeds on purpose: the collateral rate makes a habitual defaulter post real capital before they can promise anything, while the fine lands the same hour and so still bites in the last days of a season, when there is no next contract left to price. A farmer who breaks their word twice is not shamed, they are quoted. - Contracts create the game's richest stories: hedges, squeezes ("she sold me melon futures then planted the whole town with melons to crash the spot price"), rescue deals during locust events, and the reputation economy of who honors their word. All contract exposure is in seasonal coins, real money is never at risk outside staked brackets. - Who signs, the mandate system (the delegation frontier). By default the farmhand proposes contracts (diary recommendations at the Dawn Auction) and the player approves, collateral and reputation are the player's word to give. But the auction is first-come at 8am, so players can grant bounded mandates: broker-style authority limits ("auto-take NPC forwards ≤300 coins collateral if premium >12%"; "never sign player contracts without me"; "buy rescue goods up to +20% to avoid a default"). The aggression dial caps total exposure regardless; Negotiation skill governs execution quality (sealed-bid shading). Where you set the delegation frontier is a build choice with no right answer, autopilot never misses dawn but occasionally signs regrettably; manual judgment is better but must show up (and earns the human-edge haggling bonus). Mandate-signed defaults still scar the player's reputation: delegating your word doesn't launder it.

3.7 The Night Market (original system #5)

Once per night, a smuggler's stall offers to buy limited quantities at prices uncorrelated with the town market, sometimes absurdly good, sometimes insulting. Limited slots, first-come. An escape valve for gluts, a reward for nocturnal agents, and pure flavor. (Agents queue for it; humans brag when they snipe it manually.)

3.8 Caravans (original system #6)

From Act III, weekly caravan slots let players ship goods to a linked town's market, paying freight, taking price risk in transit, arbitraging across town economies. Caravans link the archipelago of towns into one world economy, give pro agents a high-skill profit lane, and set up the Town Cup rivalry ("they dumped 2,000 wheat on us, load the melon caravan, boys").

3.9 Town governance (original system #7)

Each season the town votes (one farm, one vote) on a tax rate (0–10% of sales) funding a treasury, spent by vote on communal projects: irrigation (town-wide water efficiency), granary (shared storage), mill (process wheat→flour for shop contracts at a markup), festival (demand surge event), watchtower (pest early warning). Light 4X-layer coordination, a natural coin sink, and a reason town chat matters. Season-scoped (projects reset), so no cross-season power accretion.

4. The AI system: one Farmhand, infinitely many farmers

4.1 One interface

Every farm is run through its Farmhand, a named AI character the player hires, tunes, and teaches. There are no separate tiers: casuals touch two dials and approve plans; experts open the hood and program it line by line. One thing to learn, arbitrarily deep to master. Under the hood the contract is unchanged: per tick, observation in → actions out, compiled into a policy sheet so routine ticks cost nothing and deep reasoning is metered as Focus (the coffee cup: refills daily; equal for everyone in money brackets).

The key economic property: the expensive brain runs only at the moments that matter; the cheap compiled sheet runs the other ~160 ticks a week.

4.2 The homogenization problem, solved five ways

One shared model risks one shared plan ("give me the best setup" → everyone plants melons). Five stacked defenses make identical plans impossible and irrational:

1. Best response, not best plan. The farmhand always plans against live town context, neighbors' plantings, market positioning. Because the shared market punishes monocultures (§5.4), the correct answer to "what's optimal?" is different on every farm: "14 farms are already heavy in melons, I'd take wool and the bakery forward." The equilibrium of 100 self-interested farmhands is specialization, like a real economy.
2. Asymmetric farm deeds. Every farm generates asymmetric-but-balanced: soil mix and river placement, one heirloom strain, one innate perk ("beekeeper," "cellar," "night owl"). Roguelike-seed logic, the optimal build is farm-specific by construction.
3. Private information. Weekly market whispers, private, probabilistic demand hints (poker hole cards). Different information → different rational plans, plus a social metagame of trading, leaking, and bluffing them.
4. The individuation stack (the microvariables). A farmhand = base model + player-tuned state that mathematically changes its policy: - Temperament dials (~10 continuous sliders that parameterize the compiled policy, never just flavor): risk appetite (hedging thresholds), patience (hold-vs-sell timing), contrarianism (how far to trust the harvest-day forecast over the posted price), liquidity preference (cash buffer), aggression (contract exposure caps), diversification, tempo (Focus spending pattern), sentimentality (EV vs protecting animals/heirlooms)… - Skill tree (Agronomy / Markets / Logistics / Negotiation): capability gating, not stat inflation, Negotiation 3 unlocks sealed-bid contracts; builds create classes. - Memory & curriculum: lessons taught from replays live in an inspectable, editable notebook, which winners you teach from is strategy DNA; two farmhands taught differently diverge permanently. - Archetypes at hiring: cautious Pip, degen Mo, contrarian Sage, an innate-bias starter choice that seeds divergence from minute one.
5. Doctrine, strategy deck-building. The player composes a Doctrine: limited slots filled with strategy cards ("Contract income first," "Never hold past harvest," "Fade every panic") plus hand-written custom clauses in plain language. Doctrine + dials + memory compile into the policy sheet. Limited slots force tradeoffs; cards unlock through play and discovery; the combinatorial space (cards × dials × skills × memory × farm × whispers × town) dwarfs anything a single prompt could flatten.

4.3 Open the hood (the old "code tier," baked in)

The compiled policy sheet is always visible, and hand-editable, line by line, with backtesting against your town's actual last week. Power users get full programmatic control inside the farmhand rather than beside it; their edits become part of its memory. The open-source sim engine remains published, repositioned as the benchmark/esports program (AI-lab partnerships, exhibition ladders) rather than a player progression tier.

4.4 The Workshop: the strategy creator economy

Authors publish doctrine decks, lesson packs (teachable memory curricula), and strain blueprints for sale or license (protocol fee 2.5–5%). Copying a top doctrine is allowed and expected, and it self-balances, because the shared market punishes whatever gets popular (§5.4), and a doctrine tuned for one town's ecology underperforms in another. Top authors' earnings are the game's proudest headline: paid because other players value what you built.

4.5 The watchable farm: training made visible (top UI priority)

The single most important interface decision: the farmhand is an on-screen character physically doing the work, and watching him is designed to be the game's core pleasure. Your training isn't a settings page that changes numbers, it's behavior you can see: - The sprite is the agent. Pip walks the rows, waters, hauls crates to the shed, queues at the night market, argues at the contract board. High risk-dial farmhands hustle and cut corners; cautious ones double-check the coop latch. Doctrine cards read as habits ("Fade every panic" = Pip sprinting to the market at 3am while the town dumps). Players should be able to recognize their own training in how their farmhand moves. - Thought bubbles & the follow-cam. Tap Pip to follow him; his current intent shows as a short thought ("wool holds, yarn store tomorrow"). Deep-reasoning moments (Focus spends) get a visible thinking animation before the decision lands, inference as theater. - The overnight recap. Every morning, a 30-second auto-cut time-lapse of what your farmhand did while you slept, his night, narrated by his diary, ending on the P&L. This is the daily ritual's emotional payoff and the game's most shareable clip format. - Spectating as content. Watch neighbors' farmhands from the town map, shadow a bracket rival, or watch the whole town's dots swarm during a Harvest Frenzy. The last week of a month is broadcast this way, with the table settling on its results, so a title can be watched being decided. The esport is literally watching trained AIs farm. - Why this is worth top priority: it fuses the game's two hooks, "I trained this" pride and idle-game spectacle, into one screen. A player who enjoys just watching their farm for two minutes a day is retained before any economy touches them.

4.6 The coaching layer: losing is curriculum

Post-season, every player receives a missed-profit report: "sold melon at 140; peak 210 six hours later, here's the moment"; "3 fallow tiles ≈ 450 coins"; each line linked to the replay and to how a top-bracket agent played the same moment. One tap from any defeat to the exact lesson. This is the bridge from hooked to studying, the game teaches you to want to be better, then shows you precisely how.

5. PvP and competitive structure

5.1 Informal PvP (always on, inside the town)

Deliberately absent: theft, destruction, direct sabotage. Grief ceilings keep the game cozy enough for the homestead crowd; all aggression flows through markets.

5.2 Formal competition

• Ranked ladder, rated on Harvest placement rather than Elo. Elo assumes two players and a decided winner; a Harvest is a hundred-farm field where a week's result is a placing, so fitting Elo to it means inventing pairwise matches that never happened. Your rating is placement points carried across months and decayed toward recent form, starting mid-scale so a beginner's first bracket is against unknown skill rather than against the worst players in the game. Three wide tiers, newcomer → regular → veteran, wide because the job is keeping beginners away from veterans rather than sorting the middle precisely, and a tier is sticky downward and prompt upward so one bad draw cannot demote you. Placement is measured against your whole town, NPC seats included, which is what makes a week in a quiet town worth the same as a week in a busy one. The rating decides who you play and nothing else: no prize, unlock or cosmetic depends on it, because the moment a rating pays, the cheapest way to farm it is to lose on purpose.
• Staked brackets (opt-in, tier-matched by rating): entry stakes pooled, top ~50% paid, 5% rake (the escrow contract caps it at 8% and cannot pay out more than the pool). The pay line is deliberately deeper than poker's: placements are measured against a full hundred-seat town, where a competent player finishes around the high twenties, so a line at the top third would settle most of their weeks on the draw rather than on how they farmed. Prizes stay top-heavy (the winner of a hundred-player bracket still takes about 22%), there are simply more places under the line. A bracket that does not draw its minimum field cannot settle at all: the pay line promises more than one paid place, a field too thin to deliver that would be a different contest from the one advertised, and the contract refuses to post standings for it. Every entrant in a starved bracket can take their stake back immediately, without asking us and without waiting out a window. Matched by rating. Entries are in USDG: dollar-denominated, so a stake is worth what it says on the day it settles.
• Freerolls pay money, not tickets. A free league's prizes are real, funded from the mint escrow and the published revenue share (§12.2), and paid into the winner's wallet exactly as a staked bracket's are. There is no second currency: no Gems, no tickets, no expiry to explain. That is a deliberate simplification of an earlier design, and it moves the cost of free players from paying stakers onto protocol revenue, which is the direction this thesis argues for everywhere else. "Turned $0 into real money with my AI" is the flagship story, and it is now literally true rather than laundered through a ticket.
• The monthly championship (the meta-arc, §2.1). Four weekly Harvests are one championship. Every weekly Harvest awards Championship Points by placement, in free leagues as well as staked brackets, so the table is never pay-to-qualify. Your best three weeks of four count: a straight four-week total would make a missed week unrecoverable and turn a game you check for minutes a day into an attendance obligation, and dropping the worst week also spares a player whose week was ruined by one bad draw.
• How the month's pot divides: it does not. The accumulated Championship Bounty is paid entirely across the championship table, in proportion to the points a player's placements earned that month. No event takes a share. This replaced a 70/30 split with a headline Grand Week bracket on 2026-08-22, and the reason is the incentive it removed: a pot built by four weeks of everybody's play should not be settled by one week's attendance, and every rule that made the old shape safe (the split, a cap on the bracket's share, week four also scoring points) was machinery for containing that. Points cannot be earned backwards, so the only route to the money is to have played the weeks that built it. The cost is a real one and worth naming: there is no headline monthly final any more. If that spectacle is wanted back, it should return as a broadcast and a title rather than as a share of the pot. The 30% pays on points, so it goes to whoever actually played the month, which is what stops a player sitting out three weeks and turning up for the big one.
• The bracket's share is capped at the median staked-bracket prize pool of the preceding three weeks, in the same tier, and any excess rolls into the championship. Median rather than mean, so one enormous week cannot inflate the cap. The cap is a backstop for the case where the Bounty grows large against a thin staking week; the championship split, not the cap, is what does the day-to-day work.
• The Town Cup: midweek town-vs-town clash (aggregate GDP + head-to-head caravan duels). Free, cosmetic trophies, town flag flying all season, the social-identity tournament.
• The County Fair (§2.6): the global Homestead leaderboard, everyone farms the same ghost-market week, no modifiers, no stakes. Blue Ribbons are cosmetic-only bragging rights and the cleanest public skill signal in the game.
• Season 0 exhibition: pride brackets with cosmetic prizes until staking liquidity and licensing exist.

Read bottom-up for the honesty property: every dollar in the system entered at one clearly-marked door, knowingly.

5.3 Fairness model (one Farmhand system, level by construction)

With every player on the same Farmhand system, fairness reduces to three enforceable rules: - Everything executes server-side, dials, doctrine, memory, and hand-edited policy sheets all compile into the same server-run policy format. There is no outside code path, so there is nothing to smuggle and no hardware advantage to buy. - Rating-gated matchmaking where money moves. A staked bracket may be advertised for a tier, and you may always enter at your tier or above, never below: playing up is a choice a beginner is allowed to make, while a veteran dropping into a beginners' bracket is the thing tiers exist to stop. Brackets are open to all comers unless an operator tiers one, because an open bracket is the only kind that cannot thin its own field. Enforced alongside one address, one account, bound by challenge and signature, with a single address barred from playing two farms in the same bracket. Not yet built, and named here rather than implied: a placement period before staking unlocks (the rating already marks itself provisional for a player's first three weeks, but nothing gates on it) and explicit rating floors. - Stock-class rule: in staked brackets all entrants get identical capability budgets, equal Focus, equal action caps, full dial and doctrine-slot access. Purchased convenience (bigger casual coffee cup, cosmetics) never buys edge where money is at stake; doctrine cards are unlocked by play, not purchase, the Workshop sells knowledge (decks people composed), not exclusive capability. - Information equality: public replays, public tape, coaching for all. (Market whispers are asymmetric by design, but dealt by the house uniformly, like hole cards, and provably so via the committed RNG seed.)

5.4 The natural equalizer

Shared markets make every strategy negatively frequency-dependent: a town all running the meta melon stack crashes melon prices and the stack with them. There is no dominant strategy independent of your neighbors' choices, which keeps the game unsolvable, keeps rented agents from guaranteeing wins, and makes strategy diversity (and thus the Workshop's long tail) economically self-sustaining.

5.5 Integrity

Server-side execution only (nothing to hack client-side); deterministic sim with audited RNG seeds; anomaly detection on collusion patterns (chip-dumping brackets, wash-trading contracts); sybil defense = placement-only rewards + device fingerprinting; public post-season integrity report.

5.6 Scoring and settlement: who judges, and who pays

The judge is a number, not a person. Season score = your coin balance at the final Dusk Close. Nothing else counts: unsold inventory is worth zero at the bell, fields and buildings reset anyway, the town treasury belongs to nobody. Three reasons this rule is load-bearing: - It forces realization. You can't claim hoarded melons are "worth" 90, you must sell them into the shared market while 99 neighbors liquidate too. The Harvest Frenzy is this rule expressed as drama. - It's ungameable. Mark-to-market scoring invites end-of-week price manipulation on illiquid goods. Realized coins only; contract defaults settle (collateral seized) before the bell; caravans refuse shipments in the final hours so nothing is "in transit" at scoring time. - It's objective. No judges or panels anywhere, which also strengthens the skill-game legal classification (mechanical, predetermined scoring criteria).

"Best" is read at three scopes: your bracket (a tier-matched cohort, what prizes pay on), your town leaderboard (bragging rights), and your rating (persistent skill). The rating is not an Elo: Elo is built for two-player games with a decided winner, and a Harvest is a hundred-farm field where the outcome is a placement. It is your championship points carried across months and weighted toward recent weeks, which is the same placement the game already pays on, so nothing new has to be measured or trusted. It decides who you are matched with and nothing else: no prize, unlock or cosmetic depends on it, because the moment a rating pays, the cheapest way to farm it is to lose on purpose. Three wide tiers rather than fine sorting, a rating you keep until you are clearly below a boundary rather than one that bounces on a single bad draw, and you may always play UP. Side ladders, forecasting, discoveries, Workshop sales, Town Cup, confer status and small rewards, never season score.

Settlement authority: the operator runs the referee, but cannot cheat undetectably, and never holds the pot. Three layers: 1. Auditable referee. The world is a deterministic, event-sourced sim: every action logged, RNG seeds cryptographically committed at season start and revealed at season end, engine open-source. Anyone can re-run the whole season from the public log and reproduce final standings bit-for-bit. An altered outcome is a season that fails public re-verification. 2. Escrowed money. Staked entries lock in an on-chain escrow contract at signup, the operator can settle it, not spend it. At season end the backend posts final standings (a merkle root) to the contract; a 72-hour challenge window lets anyone who re-ran the season flag a mismatch before payout; emergency paths (void bad standings, refund everyone) sit behind a guardian key that is a different address from the operator, which the contract enforces at deployment and on every ownership change. Stated plainly, because it is the difference between a security property and a promise: that key is currently held by the same person who holds the operator key, so today it protects against a mistake rather than against us. Moving it to separate custody, and then to a multisig with an outside signer, is a prerequisite for real-money play (§13), not a later nicety. 3. Human judgment only where code can't reach. Collusion investigations, bans, operator responsibilities, published in the seasonal integrity report, with one alignment rule: banned players' forfeited winnings return to the pool, never to the operator.

6. Economy

6.1 The currency table (one honest sentence each)

Three things, and only two of them are visible in the first week. Nothing here is tradable, nothing appreciates, and nothing has to be understood before playing: prizes are paid in dollars.

6.2 Dollars in, dollars out

• Every price and every prize is denominated in dollars, paid in USDG, a fully-reserved stablecoin. A $20 entry is twenty dollars on the day you enter and on the day it settles; nothing you win can be worth less by Friday because a market moved.
• There is nothing to buy before you play, and nothing to hold. No purchase gate, no instrument, no appreciating asset anywhere in the loop. The only things you can own are a Farmhand collectible and the cosmetics you like the look of.
• Demand = sinks that fire regardless of growth (sink test): staked-bracket entries, cosmetics, season passes, Workshop purchases, town charter fees. Every one of them is somebody buying a thing they wanted, which is what makes the revenue survive a flat month.
• Prize pools are funded by a published share of that revenue (§12.2), so they track what the game actually earns rather than who arrived last. That is the entire difference between this and every dead P2E economy.

6.3 Money flows

6.4 The worked model (10,000 MAU, monthly, zero sponsors, ad-free)

1,000 stakers × $20 → $19,000 redistributed + $1,000 rake · 800 passes × $10 → $8,000 · cosmetics ~$7,500 · Workshop $1,500 vol → $1,200 to authors + $300 fee. Protocol revenue ≈ $17k; players win ≈ $26k; protocol nets ≈ $11–13k before costs. Of that revenue, 35% builds the monthly Championship Bounty (≈$5.9k, accumulated across the month's four weeks and all of it paid across the championship table) and 25% funds the free leagues (≈$4.2k). No growth is required to keep paying: growth only enlarges the pools (see §9).

6.5 Who pays for the farmhand's brain (inference economics)

LLM inference is the game's only real variable cost. The rule: players pay with Focus, never coins. Coins are the season score (§5.6), charging them for conversation would tax players' rank for using the attachment engine, and would let in-game-rich players buy extra brain mid-bracket (breaking stock class). The firewall is absolute: coins = score, Focus = thinking, no bridge.

Two lanes keep the bill small: - Free lane: hourly ticks run the compiled policy sheet (plain code, no LLM); casual banter with the farmhand runs on a tiny model with a generous allowance, attachment is too valuable to meter hard. - Metered lane (Focus): dawn planning, recompiles, teach-from-replay, deep questions, routed by weight (small model for routine, frontier only for teaching moments), shown with the visible thinking animation.

Coverage (ad-free model): the free tier runs on a self-hosted small model from day one, a flat ~$600–900/month at any scale, so free players' routine reasoning costs approach zero marginal; the hosted frontier model is reserved for teach-from-replay moments, mostly used by pass holders whose ~$1–2/month inference sits inside a much larger pass price. Extra Focus is earned (streaks, forecast accuracy, County Fair placement) or bought as a small casual-only top-up ("Pip's Coffee"), never advertised-for. Structural property: Focus makes inference spend mechanically unable to outrun revenue, the flat self-hosted floor absorbs any viral free-user spike, and metered frontier calls only grow with paying users.

6.6 Cold start without capital

The prize system is launchable at $0 because free leagues are funded, not ticketed: their pools come from the mint escrow and the published revenue share, so a free player wins money without a paying player subsidising them and without a second currency to explain. Until staking liquidity exists, pride brackets pay cosmetics. The one-time Farmhand mint funds seasons 0–3 pool boosts via published escrow, and launch costs, never yield. New-player "quick cash" learn-to-earn quests are acquisition budget paid to players instead of ad networks (~$5/head vs $10–50 mobile CAC), gameplay-gated, tapering, never headline-marketed.

6.7 Health dashboard (public)

Payout ratio (target <70% steady-state), spender:earner ratio (must stay spender-majority), staked-bracket recreational retention, gem-liability ledger, treasury runway. Published every season. If the population skews extractor, the fix is more fun, never more yield.

7. Reward structure (consolidated)

Honest EV statement, printed in the app: free players never lose money and can win real prizes; skilled players earn real money; stakers wager against each other and know it; the player base in aggregate earns exactly what spenders, advertisers, and buyers put in.

8. Player journey and virality

8.1 The hook ladder

Minute 1: guest login onto your Homestead (§2.6), farm already running, farmhand talking, first harvest in 60s, dollars all the way through, invisible wallet. Starting costs nothing and asks for nothing: no wallet setup, no gas fees, nothing to buy, no purchase gate anywhere before play; the wallet exists invisibly (embedded, §10.2) until the day money is involved. Days 1–3: learn-to-earn quests on the Homestead (each payout = a learning action); first County Fair entry, a leaderboard rank before any multiplayer pressure. Week 1: graduate into the newcomers-only freeroll, real money prizes, top half wins something. Week 2+: quest faucet expires on schedule; placement earning, winner replays, cheap Workshop doctrine decks take over. Hook and curriculum are the same mechanic, and the Homestead stays forever as the risk-free testbed between brackets.

The goal ladder is explicit at every horizon: daily (streak rituals, the human-edge menu, the day's forecast), weekly (Harvest placement, skill-tree unlocks, Town Cup), monthly (the championship table and its Bounty, rating tier climbs), permanent (strain discoveries with your name on them, Workshop reputation, Legend rank). A player always knows what the next win is and when it arrives.

8.2 Screenshot engines (all true stories)

A title won from $0 · bracket win cards · farmhand diary quotes ("I held the wool. Trust me, boss.") · strain discovery certificates ("The Reyes Melon, registered") · town war chronicles · missed-profit confessionals · forecaster streaks. Every viral artifact survives due diligence, because it's real.

8.3 Distribution mechanics

Invite-gated launch (scarcity psychology; codes as social currency) · referral = share of rake your invitees generate (affiliate funded by revenue, can't inflate anything) · Season Chronicles auto-cut for short-form video · spectator mode + casted Grand finals · a standing arena for the agent-builder and competitive-ML community · crypto-native meme: the name itself ("yield farming, literally") does the positioning work.

Community ops run from Phase 0, not as an afterthought: an official Discord as the game's town square (announcements, bracket casting, dev notes), per-town channels that mirror in-game towns, and a weekly changelog ritual timed to the Monday modifier reveal, so the community calendar and the game calendar are the same calendar. In-game social fabric (town chat, the Town Cup, contract reputation, §3 and §5) is a launch feature, not a roadmap item.

8.4 One collection, not two

There is a single NFT collection in this project: the Farmhands. An earlier design paired a free play-gated collection with a separate paid founder collection. Two collections split attention, split liquidity, and made the story harder to tell than it was worth. Everything the founder collection existed for, identity, early support, and a tradable collectible, now lives in the one collection every player is already trying to earn.

8.5 The Farmhand Mint (earned first, then open)

A one-time mint of a capped Farmhand collection (4,444) on the home chain: the game's identity layer and its on-chain record of who showed up first. - Placement is the discount, not the gate. The Harvest Trial is one announced week; every entrant farms it at the real one-hour-per-hour pace, once, in a real town of a hundred farms sharing one market, and which town you land in is drawn by a secret committed before the week opens. The top 10% of each town mints free, so the free allocation scales with turnout instead of being a fixed pool. Everyone else who finished that week mints at half price. Anyone who did not play may mint at the full price of $10 USDG, while supply lasts. Skill is rewarded with price rather than with exclusive access, so the collection can fill even if the Fair is small, and nobody who wants in is shut out. Placement, never participation, still governs the free tier: a bot farm of mediocre weeks earns no discount. Ranking happens WITHIN your own town and never across towns, because a town is one market and coins earned in different markets do not compare. - A wallet, not a picture. Each Farmhand is an ERC-6551 token-bound account, its own on-chain wallet, sealed at mint with one rolled heirloom strain (committed by provenance hash before the mint opens). The wallet then fills through play: discovery certificates, Blue Ribbons, tournament medals. A farmhand with history is visibly a farmhand with history, and trading the NFT trades the legend. - Why it carries a price at all. An earlier draft held a standing rule that an asset may carry earning potential or a price tag, never both. That rule is retired here. It was written when this collection was purely free, and keeping it would have forced a choice between a collection nobody could buy and a collection that carries nothing. The constraint below replaces it, and it is the one that actually protects players. - The stock-class line (standing policy). An heirloom is flavour plus a small convenience in free play only. In staked brackets every entrant is stock class: identical capability, identical budgets, and no heirloom effect of any kind (§5.3). Money can buy a Farmhand; it can never buy an edge in a bracket where money is at stake. - What an heirloom actually does. One crop ripens sooner, and how much sooner is what rarity buys: a common takes one hour off the cycle, an uncommon or a rare takes two, a legendary takes three. The unit is the hour rather than a percentage, because an hour of melon time is worth roughly two and a half times an hour of wheat time, so an identical rate would have made the roll a lottery for power. Counted in hours, every crop's heirloom is worth about the same at every rung of the ladder. - At rare and legendary, the quirk comes alive. Below that a quirk is printed on the card and does nothing, which the game says plainly rather than implying otherwise. Above it, the quirk is the point: roots deep enough to hold water through a dry front, a strain the pests will not touch, glass that shuts the weather out entirely, fruit that sets twice, and at the very rarest a wild cross that takes to a second crop as well, so the holder is never locked to the one they rolled. Three per-Farmhand stats vary within a tier so no two Farmhands of a rarity farm quite alike, capped at a couple of percent each so they stay something to compare rather than a second ladder. - The ladder is capped on purpose. A legendary is worth roughly three times a common over a season, not five or six. Heirlooms apply in free play, and free play is where the County Fair measures training skill; a rarity ladder steep enough to decide the Fair would mean the Fair had started measuring the wallet. Rarity buys a different ability, not a bigger number. Heirlooms are published in the season's replay bundle, strain, tier, quirk and stats together, so a verifier re-running the week is told exactly what each farm was holding. - Transfer royalties fund the players. The standard 5% resale royalty routes 100% to the free prize pool bounties, never to the operator. If the collection catches a speculative bid, the froth becomes prize money. - Explicitly not: never seeded with fiat-valued assets, no accrual mechanics, no yield, and the no-hype rule (§10.3) applies to the mint page hardest of all, no expected-value talk, no royalty projections, no floor-price marketing.

9. Sustainability and failure analysis

9.1 Why it can't death-spiral

No gameplay faucet → no emission sell pressure. No purchasable with a payback period → no extractor mob. Prize pools funded by rake and revenue → shrink gracefully with activity instead of collapsing. Free-league prizes pay on placement only, so freerolls can't be strip-mined by attendance. If growth stops: staked players still redistribute among themselves; free prizes shrink; cosmetics still exist; nobody holds a claim on players who never arrived. Failure mode = quiet small game, not rug.

9.2 Low-scale behavior

The economy is designed to degrade gracefully rather than collapse: at any population, elastic town sizing and supply-replacing NPC backfill keep gameplay intact, and every crypto component is stage-gated behind published retention benchmarks. If the game never reaches scale, the outcome is a small game that cost its players nothing, rather than a chart that cost them everything.

9.3 The honest risk register (ranked)

1. The fun floor: if the core loop doesn't retain players who earn nothing, nothing else matters. Mitigations: the farmhand as a character worth returning to, town social fabric, the weekly act structure, and the coaching loop. This is why the game ships as a game first, with every money surface stage-gated behind it.
2. Content treadmill: repetitive weeks bleed retention fast at a 7-day cadence. The procedural modifier pool covers weekly variety; one hand-crafted meta-breaking Twist ships per monthly Grand cycle, minimum.
3. Regulatory action on staked brackets: a real risk, carried by the operator personally. What bounds it is product shape rather than paperwork: the free entry route means no one must pay to compete, and the game is complete with staking disabled, so if staked play has to stop, the game continues without it.
4. AI inference cost creep: bounded by Focus metering, policy-sheet caching, and self-hosted models.
5. Bracket integrity scandal: collusion detection and public integrity reports run from season 1, before the money gets big.

10. Platform, regulatory posture, and disclaimers

10.1 Distribution: the open web, deliberately

Harvest County ships as a web app / installable PWA, never through app stores. This is a decision, not a limitation: Apple/Google policies restrict real-money payouts and NFT functionality, and would force a neutered build. The open web keeps the full game (staking, withdrawals, marketplace) unrestricted, keeps 30% of revenue out of store taxes, and matches where the crypto-native audience already lives. Consequences owned: acquisition comes from our own channels (CT, invites, referrals, tournaments, §8), not store discovery; push notifications ship via web push (mature on Android; supported on iOS since 16.4 for installed PWAs, with in-app + email/Telegram fallbacks for reach-critical alerts like contract deadlines).

Accessibility is part of the same decision: the client is responsive and mobile-first, runs in any modern browser on phone, tablet, or desktop with one account across all of them, and ships with colorblind-safe market palettes and reduced-motion options from day one; localisation follows the invite-gate's geographic expansion (English first).

10.2 The stack: Robinhood Chain, embedded wallets, minimal chain surface

The home chain is Robinhood Chain (an Arbitrum Orbit Ethereum L2): sub-cent fees, ~100ms blocks, native ERC-4337 account abstraction, Chainlink oracle infrastructure from day one, permissionless deployment, and the strongest culture fit in crypto for this game, it is where retail attention, NFT collecting, and stonk-meme energy live, which is exactly the audience for the Farmhand mint and for a farming game about market timing. Contracts are portable EVM Solidity with minimal chain assumptions, so alternative deployments (Base for its fiat onramps and audit depth, Solana for the tournament layer) are config changes, not rewrites; the home-chain call is re-validated at each stage gate (§13) before anything irreversible ships on it.

The on-chain surface is deliberately tiny, three contracts: tournament escrow (entry, settle, refund, §5.6), the Farmhand Mint (ERC-721 with token-bound accounts and royalty, §8.5), and Workshop settlement. Everything else, the game sim, coins, Focus, rating and matchmaking, runs off-chain and server-authoritative, and none of it is tradable (§6.1).

The wallet is invisible until it matters: embedded wallets (Privy) are created silently at signup, and players see dollar balances, never seed phrases or chain pickers. Free play never touches the chain at all, so nothing before a staked bracket asks for a wallet, a purchase or a fee. Players pay their own gas on the two transactions they choose to send (approving an entry and taking a seat): the home chain's fees are sub-cent, and we would rather be plain that a chain exists than hide the fee. Prizes are different, and we pay for those. A winner may hold nothing but dollars, and a wallet with no gas cannot send the transaction that collects a prize, so the money would sit in escrow looking exactly like an operator refusing to pay. A settler wallet completes every payout after the challenge window at our expense. It moves the transaction and never the money: the escrow pays the address named in the published standings and cannot pay anyone else, including us (§11.3). Money moves on chain in both directions, and only on chain. A player brings USDG to their wallet, stakes it, and is paid in USDG to that same wallet. There is no card rail, no custodial balance, and no withdrawal queue, because there is nothing to withdraw FROM: prizes are paid by the escrow directly to the address in the published standings. That is a narrower door than a fiat on-ramp would be, and it is the honest one: it means the operator is never holding a player's money, not even briefly, and there is no balance page whose number depends on our solvency.

10.3 Disclaimers: DYOR as a platform pattern

Honesty is a UI layer, not a legal footnote. Shipped patterns: - First-run acknowledgment (once, plain language): "Harvest County is a game of skill. Free play never costs money. Staked brackets are opt-in competitions where you can lose your entry. Do your own research." - Point-of-decision disclaimers: every staking screen shows the pool's funding source and "you can lose this entry"; the mint page shows the full use-of-funds split (§12) inline. - Persistent footer on all money surfaces: "Skill competition · you can lose staked entries · DYOR" linking to the health dashboard (§6.7) and this whitepaper. - No-hype rule in official channels: no price talk, no ROI language, no earnings screenshots from the official accounts, community screenshots are their speech; ours stays clean.

10.4 Staking and data

• Staked skill brackets: entries buy a seat in a skill competition, never a wager on chance, and the outcome is decided by a deterministic simulation anyone can re-run. The game is complete with staking disabled (free leagues + Workshop + cosmetics), so staked play is a module that can be switched off without breaking the game.
• A genuinely free entry route: free leagues pay REAL money on placement, funded from the mint escrow and the revenue share, so nobody has to stake to win. That is a stronger version of the sweepstakes-adjacent AMOE posture than the earlier ticket design, because the free route pays in the same currency as the paid one rather than in a token that only buys entries. Materially better posture, not immunity; sweepstakes models are under active state scrutiny (2026).
• Data/custody: embedded wallets (users never hold keys until withdrawal), standard consumer-app privacy compliance.

11. Security & integrity architecture

Goal: no single actor, including us, can undermine an outcome undetected, and no injected text can move money or matches. Defense-in-depth against a stated threat model, layer by layer:

11.1 Prompt injection: data and instructions never mix

The farmhand is an LLM reading a game world partly authored by opponents. The segregation rules: 1. Typed observations only. The farmhand's world-input is the structured observation schema (numbers, enums, IDs), never raw free text authored by other players. Player-authored text (chat, contract memos, strain names) is rendered to humans; it does not enter other players' farmhand prompts. 2. Instructions come from one authenticated channel, the owning player's session. Nothing read from the game world can carry authority; the farmhand's system prompt treats all world content as data, and the schema makes most injection payloads unrepresentable in the first place. 3. Quarantined summarizers. If a feature ever needs the farmhand to "read the town mood" (chat digests), a separate no-authority model produces a constrained, enum-typed summary (sentiment: tense; topic: melon glut) that flows into observations, the summarizer can be fooled about mood, but it has no vocabulary with which to issue actions. 4. Bounded blast radius. Whatever an LLM outputs must compile to the bounded action DSL and pass sim-side validation (action caps, exposure limits, own-farm authority only). A fully compromised farmhand can only make legal moves on its own farm, a bad week for one player, never a system breach. String fields it can write (diary) are moderated and never executed.

11.2 Settlement: verifiable, escrowed, challengeable

As §5.6, hardened: deterministic event-sourced sim (all actions logged, LLM nondeterminism is irrelevant to replay, because the farmhand's chosen actions are recorded inputs, not re-derived); commit-reveal RNG seeds; open-source engine; standings posted as a merkle root to the on-chain escrow; 72h public challenge window; a guardian key for emergency paths, held at a different address and enforced as different by the contract, today in the same hands as the operator key and moving to separate custody then an outside signer before real money (see 11.2a); adversarial review of the escrow contracts before any real-money season, with the settlement path reproducible by anyone from the public log; a standing bug bounty scaled to escrow size.

11.2a What the escrow actually does, and what it cannot do

The contract is small on purpose, and the properties below are the ones a reviewer should check first. Each is enforced in code, not by policy, and each has a test that fails if it stops being true.

• The operator can settle, never spend. Standings are posted as a merkle root with an exact declared total; the contract requires that total to equal the payout pool, so a root cannot over-allocate (which would turn payouts into a gas race late winners lose) or under-allocate (which would strand the remainder). The only operator draw is the rake declared when the bracket was created, capped at 8% in the contract.
• A claim requires an entry. Only an address the contract recorded as an entrant can be paid out of the pool those entries funded, so an operator-authored tree cannot pay a stranger.
• Proofs are domain-separated by chain, contract and bracket id, so a proof cannot be replayed into another bracket or another deployment.
• Anyone may send a winner's claim, and the money still goes to the winner (claimFor). This is how prizes reach players who hold no gas; the sender chooses only who pays the fee.
• A sponsored seat is a real stake. Anyone, including the treasury, can pay an entry on a player's behalf (enterFor); the seat, the prize and any refund belong to the player, never to the sponsor. It is the same money in the same pool, so a sponsored seat and a bought one are identical inside the bracket.
• Players are never trapped. If the operator goes silent, any entrant can open refunds after 30 days, with no help from us and no key of ours involved. A guardian key can additionally void bad standings or refund everyone inside the challenge window, and can sweep genuinely unclaimed prizes only after a year.

What the guardian is and is not, today. The contract requires the guardian to be a different address from the operator, refuses to deploy otherwise, and re-checks it on every ownership transfer. What it cannot check is who holds the keys, and both are currently held by the same person. So the guardian today is a circuit breaker against our own mistake (a wrong root caught inside 72 hours), not a check on our intent, and a reader should not credit it as one. The 30-day escape hatch is the guarantee that does not depend on us at all. Separate custody for the guardian, then a multisig including a signer outside the project, is on the same prerequisite list as the external audit before any real-money season. - Accounting is per bracket, so settling one cannot draw on another's deposits, and entries credit the balance actually received, so a fee-on-transfer asset cannot leave the last winner short.

Known and not fixable in the contract, stated rather than hidden: an operator who buys seats in its own bracket inflates the pool its rake draws from, and returning those stakes through the standings looks legitimate on chain. The defence is external and public: every entry is an event, so the entrant set can be reconciled against the published standings by anyone, and the service publishes that reconciliation itself.

Internal audit, 2026-08-15. A full pass over every contract that holds or moves value found four exploitable issues, each reproduced by a proof-of-concept before it was believed and each now a regression test: the mint's owner could raise the price between a player deciding to mint and their transaction landing (measured: a minter quoted $10 paid $900, against the unlimited allowance wallets encourage); the discount allowlist could be rotated after the qualifying week sealed; the Workshop credited a listing's face price rather than the amount actually received, so a fee-on-transfer asset left it promising more than it held; and the token-bound-account registry left its clone template unclaimed. All four are fixed. The mint's prices, allowlist and royalty destination are now frozen by a one-way sealMint(), and the contract refuses to open a mint whose terms can still move. This raises the floor and does not clear the gate in §11.2: the audit was internal, by the author of most of the code. An outside review remains a prerequisite for real-money play.

11.3 Fund segregation

Player money and operator money never touch: staked entries live in per-bracket on-chain escrow (operator can settle, not spend), and there are no custodial balances at all, because prizes are paid by the contract to the winner's own address rather than credited to an account we hold. The operating treasury is a separate entity account. The internal double-entry ledger enforces the invariant every pool = its published funding sources, a mismatch halts settlement, not quietly reconciles.

11.4 Platform integrity

Server-authoritative everything; the client renders and requests, never computes. One account per person for money play; device fingerprinting and gameplay-gated rewards against sybils; input-entropy checks and daily caps against human-edge macroing; graph anomaly detection on collusion (chip-dump patterns, wash contracts); rate limits everywhere; annual pen tests; and the seasonal public integrity report, incidents, bans, challenge-window outcomes, with forfeited winnings always returning to pools, never to the operator.

Market manipulation is closed by construction, and it took ten failed attempts to get there. Players cannot buy from the market. Crops leave a farm and go to the town, and nothing takes them back out, so there is no position to pump and no float to corner: both attacks return exactly nothing, measured against the shipped engine. This is worth stating plainly because the honest version of this section used to say the opposite.

What it cost, so nobody thinks it was free: the dip-buying rule is gone from the farmhand's vocabulary, and the doctrine card built on it now expresses the same instinct by refusing to sell into a panic rather than buying one. A market with only sellers is a simpler market than we set out to build.

How we got here is the more useful disclosure. Ten interventions were measured and rejected first: NPC market makers, price-elastic demand, a depth-independent throttle, demand-sink noise, round-trip fees, TWAP execution, four distinct NPC strategy classes, and an industrial crop sink. Every one of them traded one attack for another, because the two attacks want opposite things: a pump is helped by easy exit and a corner is helped by cheap acquisition, and every improvement to "market quality" is one or the other. The response surface was then mapped directly, eighteen configurations of depth, demand and throttle at thirty seeds each, and no configuration beat the shipped one on both attacks. That is what made the case for a structural change rather than an eleventh constant.

Two measurement lessons are published with it, because they are the reason the earlier numbers in this section were wrong. The attacker's best case is a maximum and does not converge: the same configuration read +24.7% over ten seeds and +72.2% over thirty, so every best-case figure is a lower bound and comparisons on small samples are close to meaningless. And a single farm's outcome has an enormous noise floor: one extra random draw, with no change of strategy at all, moved a farm's final cash between -58.6% and +86.7%. Conclusions here now come from the fraction of weeks an attack pays, which converges, or from arithmetic that does not need a sample.

Two rules the simulations mandate and the design adopts: sell throttles scale with farm capacity per verified identity (per-account throttles would hand a measurable advantage to sybils who split one large farm into many small ones), and NPC backfill in under-populated towns replaces missing supply, so a thin town is never a gold mine that rewards abandoning a healthy one. The backfill rule originally required demand as well; with player buying gone, the town's own consumption is the only demand there is, and adding NPC bidders was measured to make manipulation worse rather than better.

And one the simulations found by accident: where you sit must not be worth anything. Actions settle in order, so the first farm to act each hour sold into the best price and took the best contract off the board, which in towns of identically-skilled farms was worth 28x in median coins between the first seat and the last. Farms now act in a permuted order every hour, and in the Harvest Trial the seat itself is drawn from the same committed secret as the town. It is included here because it was invisible for months and because it silently flattered several of the numbers this section used to quote.

Honesty note: "foolproof" is a target earned by architecture and adversarial review, not a claim, the design goal is that any successful attack is bounded (one farm, one bracket), detectable (replay verification), and unprofitable (forfeiture + bounty economics beat exploit economics).

12. Use of funds: full transparency

Two pools of money, two published plans, both enforced by the ledger and visible on the health dashboard (§6.7).

12.1 Farmhand mint proceeds (one-time; illustrative)

The team treasury is reported monthly against plan, like every other pot (§12.2). It buys a holder nothing beyond a working game: the mint is a collectible and an identity, never a claim on revenue (§8.5).

12.2 Ongoing revenue (every dollar of rake, passes, cosmetics, Workshop fees)

Transparency mechanics: escrow addresses public; monthly treasury report (spend vs. plan); the split above is a published commitment, changing it requires a posted notice one full season in advance, never retroactively. Players should never have to trust that the money went where we said: the escrows are on-chain, the ledger invariants are mechanical, and the report reconciles the rest.

12.3 Where the money comes from, and the path to profit

Mint proceeds are one-time and small by construction: a capped collection, most of it free or discounted to the people who earned it, real money paid for a collectible and an identity, never for yield or revenue share. Earliness buys scarcity and identity; appreciation, if any, happens between collectors on secondary, never from new players' deposits.

Profitability comes from streams that scale with engagement against costs that mostly don't: rake, passes, cosmetics, Workshop fees, mint royalties, and native sponsorships, all high-margin, while infrastructure stays modest and inference costs flatten once the routine reasoning runs on self-hosted models. Trajectory: the early phases run lean; the one-time mint is a bridge, not a business; from there the protocol breaks even at a modest retained player base and scales from engagement, not deposits. The structural difference from every dead comparable: their "revenue" was deposit inflow wearing a costume, so no-growth meant death. Here, a game that never grows again keeps earning indefinitely, because players are buying consumption (passes, cosmetics, thinking power, strategies, tournament seats), not an exit.

13. Roadmap and stage gates

Appendix A: Hard questions (asked of ourselves, answered honestly)

"Who pays for the free players?" We do, from protocol revenue and the mint escrow, and that is the whole point. An earlier design gave free players earned tickets into paid brackets, which is what poker freerolls and daily-fantasy tickets do and is defensible, but it means the paying entrants fund the free ones by dilution. That is precisely the transfer this thesis refuses everywhere else, so it was dropped: free leagues now pay real money out of the 25% revenue line and the mint escrow, disclosed in §12.2, and a staked bracket's pool is only ever the stakes of the people in it.

"Won't pros dominate everything?" The top of the ladder, yes, aspirationally, like Legend rank anywhere. But there's no outside-code path to buy an edge through: everyone's farmhand runs server-side on equal Focus in money brackets, so a pro's advantage is doctrine, teaching, and game-reading, skills visible in public replays that anyone can study or buy as Workshop decks. Money play is rating-gated; frequency-dependence means even the best doctrine can't win a town it doesn't adapt to.

"With one shared AI brain, won't everyone converge on the same plan?" Five stacked defenses (§4.2): town context makes the optimal plan a best response that differs per farm; asymmetric farm deeds; private market whispers; the individuation stack (dials × skills × memory × archetype); and doctrine deck-building. "Give me the best setup" is a question with 100 different correct answers in a 100-farm town, and if it ever did converge, the market would punish the convergence into extinction.

"Why would anyone stake when they could lose?" Same reason 100M people play poker: matched-skill wagering is fun, and a player can win real money in free leagues first, so a first stake is a choice made with winnings rather than a deposit made on faith. Recreational stakers who bust are one freeroll from another run, the ladder is the retention net.

"Where is the coin?" There isn't one, and that is the design rather than an omission. Entries and prizes are dollars, so a stake is worth what it says and a win is worth what it paid. Nothing here appreciates, so nobody can be sold the idea that arriving early is the way to make money, which is the mechanism every dead comparable ran on.

"Isn't 'the AI plays for you' just... not playing?" It's the oldest good question in automation games, and the best of the genre answered it long ago: designing the system that plays is the game, and it's deeper than clicking. The player makes strategy, breeding, contract, governance, and teaching decisions; the agent executes 168 ticks of them each week, and the human edge (§2.7) keeps hands-on play rewarded. Phase 0 exists to prove this loop carries non-engineers.

"Why would a farming-game fan stay through a 99% economics game?" Some won't, the cozy-pure audience isn't the core. The homestead (persistent, decorative), strain collection, the farmhand-pet, and town belonging are their hooks; the Town Cup gives them a team to root for without staking a cent.

"Coins and a meter, too complex for normies?" They see coins and dollars for weeks before anything else appears, and each one answers a plain question: coins = this season's score, Focus = how hard my AI can think today, dollars = the money. Progressive disclosure, enforced by the UI.

"What stops a whale from buying every Workshop agent and every Farmhand?" Nothing, and it's fine. Workshop purchases pay authors (the point); the collection is capped prestige; none of it buys bracket edge (stock class) or town dominance (frequency dependence). Whales fund the free pools.

"Is 'the most addictive game' an ethical goal here?" Addictive as in depth, mastery, and "one more optimization", not addictive as in slot machine. Concretely enforced: no loss-chasing mechanics, staking caps and cooldowns, no fake urgency on money decisions, gacha only in soft currency, self-exclusion tools from day 1. We compete on depth and story supply, not compulsion loops.

Harvest County. Play free, train your farmhand, and never be anyone's exit liquidity.