Don't trust.
Verify every game.

• Every card is valued at its real market price (Cardmarket for Pokémon and One Piece, TCGplayer for Riftbound). Each pack publishes its full odds table — per booster slot, to the part-per-million — and the SHA-256 of that table.
• The pack price is its expected value ÷ the return shown on the pack (normally 85%) — every pack shows its exact RTP before you buy.
• Hitting Rip commits a server seed; then you pick one of 8 sealed packs on the shelf — the pick is part of the nonce, so we can't know which pack you'll take.
• Old results stay checkable forever: every odds table ever served is kept by its hash.

h      = HMAC_SHA256(serverSeed, `${clientSeed}:pick:<n>:${i}`)   // card i, pack n
f0, f1 = first two 4-byte chunks of h ÷ 2³²
roll   = floor(f0 × 1,000,000)            → tier by slot i's cumulative ppm
card   = tier.cards[ floor(f1 × tier.cards.length) ]   // cards sorted by id

• The server seed is committed when the group pack is created. When the last seat fills, every human's seed is combined; bots are the house and add no entropy.
• Everyone opens the same packs: seat s, round r draws with nonce battle:r:s.
• Standard: the highest total wins every card. Crazy: the lowest total wins.
• Terminal: only the last pack counts — the side with its single best card wins. Crazy Terminal: the side whose best card of the last pack is the cheapest wins (so it isn't a 2¢ tie every time).
• Lucky Draw: a side's odds are its share of the value unboxed; one draw decides. Crazy Lucky Draw: your weight is what everyone ELSE unboxed.
• 2v2: teams add up. 2v2 pays out in BALANCE ONLY — no cards are handed over or minted: each player of the winning team gets exactly half the pot's value (every card at its real price) in balance, the odd cent to the first seat. A bot teammate's half stays with the house. The group pack's page, the notification and /lookup all show it. Ties are broken by the seed, never by us.
• Private group packs can be sponsored — the creator pays every seat; seats filled by bots are refunded.

clientSeed = sha256(humans' seeds in seat order, joined by ":")
pulls      = drawPack(pool_r, serverSeed, clientSeed, "battle:<r>:<s>")
jackpot    = HMAC(serverSeed, `${clientSeed}:jackpot`).f0 → walks the sides' shares
tiebreak   = HMAC(serverSeed, `${clientSeed}:tiebreak`).f0 × tied.length

• Opening the Upgrader commits a server seed before you choose anything.
• Your chance is exact: stake ÷ targets × the return set when the Upgrader opens (normally 95%), in parts per million, rounded DOWN — never up. The chance on screen is always the one rolled.
• Jumps outside 0.01%–80% are refused, not rounded.
• Aim at up to 5 cards at once — the chance uses their total, and a hit gives you all of them.
• Roll under: you win on the first chance-ppm of the dial. Roll over: on the last.

chance_ppm = floor(stake / targets × 0.95 × 1,000,000)
r          = floor(HMAC(serverSeed, `${clientSeed}:upgrade`).f0 × 1,000,000)
under wins if r < chance_ppm · over wins if r ≥ 1,000,000 − chance_ppm

• Every match commits a server seed when it's created; both players' seeds are combined when it starts.
• All randomness in the match — shuffles, coin flips, prize cards — comes from one generator seeded by that result.
• The exact rules of every card in the match are frozen by hash, so a match replays identically forever. Open any match's replay to re-run it from the seeds.

seed = HMAC(serverSeed, `${sha256(seedA + ":" + seedB)}:duel`)
rng  = seeded generator(seed) → every shuffle, flip and draw, in order