Graceful shutdown
Stop issuance. Reveal claims. Preserve every funded right.
An irreversible transition
Only the platform can start shutdown. The factory records a permanent timestamp. New launches, pack requests, and seals stop immediately, and sealed transfers freeze before any shutdown contents are published.
All paid but unsealed requests become fully refundable to their payers. Anyone may execute the refund. Existing token markets keep operating and can still graduate.
Reveal to the existing owner
Outstanding sealed packs are revealed through permissionless transactions using published manifests. The protocol captures the existing owner; a caller cannot redirect the cards. A late reveal gets at least 30 days from the successful reveal transaction.
Still-live decision windows at shutdown extend to at least 30 days after shutdown starts. Already expired or kept pulls do not regain cash protection. No action at the new deadline means Keep. Unrevealed claims never expire and their reserves cannot be swept.
Conditions for service closure
Final closure requires at least 30 days since shutdown began, no pending payments, no unrevealed packs, no protected decisions, and disclosure of every token’s accounting leaf. Expired decisions must be settled before closing.
If an archive is missing, closure must wait. A timer alone cannot erase that obligation. Public handoff data must include manifests, aggregate witnesses, contract addresses, and transaction calldata before operators retire.
What remains
ERC-20 trading, permanently locked liquidity, additional pool positions, creator locks, fee claims, automatic swap burns, NFT transfers, and settled backing/earnings redemptions remain onchain. Metadata hosting and market discovery may need replacement clients or mirrors.
All private issuance accounting is disclosed during shutdown. A token graduating later can initialize earnings from those public totals without the original backend.