woodland.sh (alpha)

1. Player chop — player_chop_covenant_script

The player half proves owner-specific state continuity. It requires player input zero, the two-input/four-output swing shape, the same player P2TR and 330 sats, and one genuine world TREE marker with unchanged tree P2TR and value at both tree endpoints.

preserve: player P2TR, 330 sats, PLAYER_ID, XP asset
advance:  roll = SHA256(previous roll), canonical luck credit
derive:   reward threshold from input XP asset balance
pin:      merged extension, canonical anchor, immutable TREE asset

It validates the canonical reward calculation but leaves the actual health, LOG, and XP deltas to the reciprocal tree script. This keeps owner continuity on the player side and global supply accounting on the tree side.

2. Player renewal — player_renewal_covenant_script

This exact-state self-send program is used by both the owner-renewal and watchtower-renewal leaves. The base intent proof has a fake message input at index zero, the real player VTXO at index one, replacement state at output zero, and the extension at output one. A fee-bearing proof adds one clean wallet input and same-contract change.

same P2TR and 330 sats
same roll and luck packets
same one-unit PLAYER_ID
same LOG and XP presence and balances
optional fee input and change are asset-free with the same P2TR
no assets in the extension output

The owner leaf requires owner, operator, and emulator. The watchtower leaf replaces the owner with the low-authority rollover key. Both execute the same preservation program, so the watchtower cannot chop or withdraw.

3. Player LOG withdrawal — player_withdraw_covenant_script

The transaction spends player state plus one ordinary wallet funding input. It recreates player state, sends LOG to the owner-selected destination, and carries the standard extension and anchor.

player LOG in - player LOG out = destination LOG
player XP in                    = player XP out
destination sat value           = wallet funding input value
player state value              = 330 sats before and after

Roll, luck, XP assets, and PLAYER_ID are preserved exactly. The destination script is intentionally unrestricted because LOG is liquid. The player’s 330 sats never fund the destination.

4. Tree chop — tree_covenant_script

This is the main game-rule program. It requires tree input one, two inputs, four outputs, and the canonical PLAYER_ID, TREE, LOG, XP, STONE, and IRON ORE asset groups when present. It authenticates all six spending leaves and the NUMS internal key of the owner-specific player contract, rejecting alternate escape paths. Player and tree scripts, sat values, immutable tree state, the extension, and the anchor must all be canonical.

The script hashes the previous player roll, converts the new roll into a bucket modulo 10,000, derives probability from the input XP asset balance, applies bounded luck credit, and leaves one canonical reward bit G.

tree health in         = tree health out + G
tree LOG in            = tree LOG out + G
player LOG out         = player LOG in + G
tree XP in             = tree XP out + G
player XP out          = player XP in + G

Each successful G transfers one soulbound XP asset unit, which deterministically represents 25 user-facing Woodcutting XP.

It also requires positive input health and one conserved TREE marker. A miss has G = 0: assets and health stay fixed while roll and luck still advance.

5–6. Tree regrowth and maintenance

tree_regrowth_covenant_script and tree_maintenance_covenant_script share exact P2TR, sat-value, immutable-state, TREE, LOG, and XP preservation, but their health rules and signer closures are disjoint.

funded-stump regrowth:
    input health = 0 and LOG reserve > 0
    output health = 10
    signers = operator + tweaked emulator
active or terminal maintenance:
    output health = input health
    signers = operator + rollover + tweaked emulator

No timer or height witness gates either transition. Regrowth derives eligibility from the stump’s conserved local LOG reserve; maintenance cannot change any state.