AICoreArena frozen stakes and permanent-death boundaries
    √ rejects implementation initialization and proxy re-initialization
    √ escrows two existing eggs, reproduces the result and only transfers existing rewards
    √ rejects self-battles and wrong-parent or previous-day eggs
    √ rejects unsolicited Core NFTs without escrow rights
    √ freezes match limits at invitation creation and appends configuration versions
    √ allows cancellation only before acceptance and preserves a refundable exact egg
    √ allows permissionless expiry of waiting invitations without granting a fight refund after acceptance
    √ rejects duplicate daily participation even after loss and revival
    √ prevents parallel invitations from reusing a monster or egg
    √ settles across midnight using the accepted day and frozen Core rule versions
    √ still pays frozen egg rights after the loser is globally burned while waiting
    √ still pays frozen egg rights after the winner is globally burned while waiting
    √ still pays frozen egg rights after the both is globally burned while waiting
    √ does not resurrect a dead maker when a waiting invitation is cancelled
    √ ignores repeated oracle words, authenticates callbacks and rejects settling before ready
    √ accepts old-source callbacks after reconfiguration and isolates colliding source request IDs
    √ pauses new entry without blocking accepted settlement or payout
    √ blocks an authorized beneficiary from recursively claiming a second egg during an ERC721 callback
    √ preserves accepted stakes, randomness and daily records through an authorized UUPS upgrade
    √ produces bounded and reproducible eight-round fights

  Real linked Core / Treasury / Arena / Population / Market integration
    √ deploys the linked production Core below EIP-170 and protects every cross-module hook
    √ preserves the lifetime 50 mint limit after transferring every minted NFT away (95ms)
    √ holds out-of-order random callbacks behind FIFO and cannot double-claim consumed eggs
    √ queues LP only at the 100th real hatch and preserves mixed historical hammer prices (212ms)
    √ burns actual feed/potion ENCR and retains the purchased production version across rules updates
    √ settles an accepted real battle after both fighters are permanently culled without adding reward eggs (103ms)
    √ keeps DOWNED monsters counted and revives using the frozen entry cost, once (82ms)
    √ settles market payments from frozen fee terms and locks listed assets against transfer or hatch
    √ rolls back all payment and listing state on NFT rejection and blocks receiver reentry
    √ rejects false-return and fee-on-transfer payments without losing the listed NFT
    √ allows a listed monster to be globally culled while rejecting payment for its stale listing (51ms)
    √ rescues dystocia under the feeding version, burns its exact ENCR cost, and produces one existing entitlement
    √ permanently burns unrescued mothers and releases the reserved breeding capacity (40ms)
    √ freezes an upgrade attempt, and its failure lowers the monster to a level from 1 through 9
    √ draws a full replacement roster without repeated positions or an unbounded random tail (109ms)
    √ does not count hatch arrivals after a daily snapshot as replacements in that frozen epoch (52ms)
    √ safely handles market fees credited to the seller or to the buyer itself
    √ escrows and transfers official potion balances through the real Core without duplicate spending
    √ keeps a 64-action random callback constant work and settles in two bounded 32-action calls (215ms)
    √ preserves accepted battle escrow and a pending paid hatch across a real Core implementation upgrade (98ms)
    √ receives an authenticated production-adapter callback into the real Core batch and settles its original opening
    √ keeps the same paid hatch queued when direct VRF lacks funds, then dispatches it once after funding
    √ rolls back a taker stake and daily battle quota when direct randomness cannot be funded (73ms)
    √ rolls back an unfunded population snapshot and admits its pending newborn once after a funded daily draw (60ms)

  Deployment journal exact-input binding
    √ retains exact intent across harmless fee/nonce changes
    √ rejects changed deployment bytecode, call target, calldata or value before broadcast

  Resumable deployment constructor deadlines
    √ persists the initial timestamp and preserves the exact constructor intent after restart
    √ stops a long interruption before preparing a replacement constructor
    √ retains a completed LP deployment even after its constructor deadline has passed
    √ recovers a legacy completed deadline from the verified deployed vault instead of the current clock
    √ refuses ambiguous legacy prepared transactions without changing the journal
    √ refuses inconsistent persisted timestamps

  BSC fork: genuine Chainlink V2.5 Wrapper direct payment and authorized callback routing
    - pays the genuine Wrapper exact current quote and routes the real Wrapper callback to its local committed nonce
    - stores a genuine Wrapper result despite consumer failure and retries without paying or requesting a new result
    - rejects missing funds and the fee cap before the real Wrapper records a request

  Native direct-funded VRF: local nonces, actual fee credits and frozen callback authority
    √ pays the exact per-transaction Wrapper price and maps its opaque ID to a distinct local nonce
    √ rejects initialization, Owner word injection and unapproved consumers
    √ reverts insufficient-balance or excessive-fee requests atomically without consuming a nonce or paying the Wrapper
    √ rolls back a failed Wrapper and rejects ID reuse without overwriting an original commitment
    √ accepts a zero word once and never pays for or delivers a reroll
    √ retains a verified word through consumer revert or callback gas exhaustion, and retries without new payment
    √ isolates matching external IDs on a newly configured Wrapper and freezes both original authorities
    √ preserves committed rights after revocation and prevents same-result callback reentry
    √ validates a real V2 layout and preserves paid pending delivery through a UUPS implementation upgrade (205ms)

  Genesis synthesis, potion escrow and Beijing-08 dividend snapshots
    √ gives the Owner exactly one initial card, with neither level nor rarity, and cannot initialize twice
    √ atomically converts exactly ten idle SSS monsters, updates rosters and emits no random-death records
    √ rejects duplicates, foreign assets, wrong rarity, active production and frozen snapshots without partial destruction
    √ unlocks at exactly Beijing 08:00 and preserves the previous holder claim after a boundary transfer
    √ awards a day to the last holder before 08:00, even if the seller claims first afterward
    √ shares by card count and the end-of-day supply, preserving entitlement across later supply dilution (45ms)
    √ paginates multi-year backlogs without skipped days or off-chain rollover transactions (59ms)
    √ rejects unauthorized history writes, restores cursor on failed payout and stops reentrant double claims
    √ escrows virtual potions out of the seller spendable balance and releases the original quantity
    √ exposes production hooks with access control and remains below EIP-170 (50ms)
    √ rejects opening a real Genesis card without consuming hammers, changing shares or queuing a reward draw (48ms)

  Immediate upgrade authority and V1 migration boundaries
    √ validates retained V1 GameRules storage against its immediate-upgrade successor (84ms)
    √ validates retained V1 EnergyCrystal storage against its immediate-upgrade successor (74ms)
Warning: Potentially unsafe deployment of contracts/AICoreGame.sol:AICoreGame

    You are using the `unsafeAllow.external-library-linking` flag to include external libraries.
    Make sure you have manually checked that the linked libraries are upgrade safe.

    √ validates retained V1 AICoreGame storage against its immediate-upgrade successor (66ms)
    √ validates retained V1 AICoreArena storage against its immediate-upgrade successor (85ms)
    √ validates retained V1 GameTreasury storage against its immediate-upgrade successor (111ms)
    √ validates retained V1 PopulationManager storage against its immediate-upgrade successor (67ms)
    √ validates retained V1 AICoreMarket storage against its immediate-upgrade successor (75ms)
    √ validates retained V1 ChainlinkRandomSource storage against its immediate-upgrade successor (60ms)
    √ validates retained V1 ChainlinkDirectRandomSource storage against its immediate-upgrade successor (70ms)
    √ upgrades immediately while the same Owner cannot bypass the 48-hour parameter governance (86ms)
    √ migrates a real old rules proxy atomically without repricing its existing rules (116ms)
    √ preserves legacy balances/allowances and initializes the previously absent permit domain once (112ms)

  Restricted persistent keeper on an isolated in-process chain
    √ turns 100 actual consumed hammers into automatic funded LP execution and later settles all openings (1310ms)
    √ does a dry run without reading a key or signing, and serializes process ownership (384ms)
    √ refuses an Owner wallet, a mismatched runtime or an ungranted keeper role before signing (58ms)
    √ refuses a keeper that holds immediate upgrade authority on any protected module (172ms)
    √ refuses every directly granted Timelock governance role before signing (97ms)
    √ pauses an unrelated pending keeper nonce instead of signing above an unknown transaction
    √ indexes ready births and expired distress from events without an NFT-wide scan
    √ bounds RPC concurrency at two even when a configuration requests more parallelism (90ms)
    √ automatically requests an event-indexed ready birth and expires its unrescued distress later (328ms)
    √ finishes population replacement across days, admits one newborn, and does not cull again without births (349ms)
    √ retries an already stored VRF delivery from events without buying another random request (103ms)
    √ recovers an accepted broadcast timeout from its hash before issuing the next nonce (66ms)
    √ settles an accepted event-indexed Arena battle while leaving both egg claims with the real winner (383ms)

  Unified NFT / potion marketplace: escrow, frozen seller fees and atomic payment
    √ lists and transfers both egg kinds, ordinary monsters and kind3 Genesis without NFT approvals
    √ escrows exactly the selected existing potions and sells the entire pack at its total price
    √ cancels back to the original seller once and blocks an unauthorized cancel, self-buy and double-buy
    √ prevents empty, unfunded and duplicate potion commitments without consuming offer IDs
    √ holds each fee and fee recipient at listing time and does not retroactively reprice an old 3% offer
    √ uses one exact-amount permit transaction, consumes its allowance and rejects replay and foreign callers
    √ buys a kind3 Genesis NFT with an exact permit and no separate NFT or ENCR approval transaction
    √ refuses expired permits with no standing allowance and retains the complete potion offer
    √ accepts an already submitted exact permit and never signs or spends for the copied caller
    √ rejects a stale permit price before using its nonce or moving escrow
    √ atomically rolls back the exact payment, permit and listing when Core cannot deliver the potions
    √ rolls back false-return and fee-on-transfer tokens without releasing any potion
    √ keeps a successful potion sale when fee auto-conversion fails and blocks converter reentry
    √ blocks a malicious Core reentering the listing during potion delivery
    √ supports independent NFT and potion ID spaces and bounded pagination across cancelled offers
    √ handles the fee recipient being the seller or buyer and rounds only the seller fee down
    √ uses append-only storage for a real upgrade that retains an open 3% NFT listing (100ms)

  Verified AI-wallet free mint and ordinary 0.005 BNB mint policy
    √ initializes the egg sale closed and reports the current operation switches without changing storage
    √ blocks ordinary, Owner, verified-AI and referral mints while closed without payments, rewards or quota changes
    √ starts with no qualified wallets and quotes every ordinary wallet including Owner at 0.005 per egg
    √ forwards exactly price times quantity to Owner and keeps Mint revenue outside hammer/LP balances
    √ allows only authorized evidence-backed AI eligibility, with no user boolean or provider-name bypass
    √ evaluates eligibility for the actual sender rather than a different qualified quote address
    √ rejects both underpayment and overpayment atomically without binding referral or issuing rewards
    √ expires exactly at its recorded deadline, revokes individually, and invalidates a removed verifier issuer
    √ validates evidence, expiry and a bounded registration batch
    √ shares the same lifetime quota and per-transaction limit after changing wallet eligibility
    √ shares the final 9999 supply boundary between paid and verified AI wallets
    √ pays referral once per first mint, independent of quantity, paid status and later AI eligibility
    √ allows only parameter governance to change registry, ordinary price or Owner payout address
    √ rolls back the full mint if its configured income recipient rejects BNB
    √ fails closed to ordinary payment if a configured registry cannot answer
    √ migrates a previously free V1 ledger without altering old mint counts or existing NFT ownership
    √ retains the intended deployment size ceiling with no unlimited-contract exception

  Owner Genesis issuance with canonical ERC721 and dividend hooks
    √ issues directly while egg mint is closed without charging or consuming the egg pool/referrals
    √ respects the 25-per-transaction bound without imposing an unrequested total supply cap
    √ uses the immediate project Owner role rather than the parameter Timelock
    √ rolls back an entire batch when a later safe receiver callback rejects it
    √ rejects reentrant issuance even when the receiving contract holds upgrade authority
    √ never grants completed-day revenue to newly issued cards and dilutes subsequent day pools by count
    √ trades issued Genesis cards with correct share migration while keeping every monster/egg action excluded
    √ keeps production runtime below EIP-170 after the read view and Owner issuance additions

  ChainlinkRandomSource authenticated stored words and retry boundaries
    √ locks implementation initialization, protects governance and validates exact V2.5 request ABI
    √ accepts exactly one authenticated word including zero, and ignores duplicate coordinator attempts to reroll
    √ stores a word despite consumer revert, retries the same result permissionlessly and never requests a fresh word
    √ retains the stored result when a consumer exhausts its entire callback gas allowance
    √ can defer low-gas delivery and later deliver without changing the authenticated word
    √ keeps an old coordinator authorized only for its original requests after future configuration changes
    √ preserves outstanding rights after consumer revocation and rejects a coordinator ID collision
    √ prevents a consumer from recursively receiving the same callback twice
    √ rejects empty coordinator, subscription, key lane and unsafe callback parameter bounds
    √ retains a failed outstanding delivery and its original coordinator through a UUPS upgrade

  Recycling NFT fees on genuine BSC Router and Chainlink feed (isolated local fork)
    - releases from BLACKHOLE, forms the real pair, waits for a mature TWAP and sells a >= USD10 fee batch into BNB

  Recycling reserve, permit payments and NFT fee sale
    √ places all 10 billion at BLACKHOLE, with no Owner/team/liquidity allocations
    √ prevents direct reserve withdrawals, even from an impersonated BLACKHOLE allowance
    √ releases actual existing tokens, then recycles feeding without inflating or burning supply
    √ has no daily/season administrative caps or 75% decay, even after cohort 256
    √ reserves future reward tickets and rejects overcommitment
    √ recycles potion payments and direct donations once, keeping accounting solvent
    √ buys a missing hammer and queues one opening atomically in the production Core
    √ uses a bounded permit plus action in one transaction and rejects replay/foreign spending
    √ keeps production Core below the EIP-170 code size limit
    √ pays 5000 / 3000 / 2000 immediately from BLACKHOLE in the invitee first mint transaction
    √ rejects self-referrals and unactivated inviters, and never permits late binding
    √ holds fees below USD 10, then automatically sells the qualified batch to BNB
    √ keeps the original fee balance on stale oracle, guard rejection and failed swap
    √ retains failed beneficiary credit without allowing a gas-consuming wallet to exhaust the caller
    √ completes the actual NFT purchase even when automatic fee payment meets a gas-burning beneficiary (47ms)
    √ sells official potion revenue into the shared Genesis dividend vault in the buyer transaction (47ms)
    √ recovers only the Genesis vault own retained collector credit after a temporary receiver failure (48ms)
    √ trades the real Owner Genesis NFT while the old holder keeps already matured dividend rights (66ms)

  BSC mainnet fork: real Pancake V2 Treasury routes (local writes only)
    - bootstraps an actual Pancake pair only from 100 consumed hammer receipts and sends LP to a real Timelock
    - executes a second funded batch through the real swap/add path, preserving unused ENCR as LP carry
    - rolls back a real-router slippage failure and retries the same batch without double-spending
    - observes a genuine Router BNB refund on an imbalanced direct add, separately from Treasury carry

  GameTreasury paid-credit conservation and restricted LP execution
    √ requires funded initial token budgets and cannot reset those budgets
    √ restricts purchase, consumption and reward payments to Core
    √ does not trigger LP batches for purchases until exactly 100 actual consumptions
    √ consumes FIFO paid credits: 20 old-price + 80 new-price hammers produce exactly 0.09 BNB
    √ keeps historical LP splits when later purchases use a different split
    √ applies a changed threshold only to the next batch, including multiple closures in one call (40ms)
    √ does not strand FIFO funds when all lots are consumed and the same version is bought again
    √ preserves odd-wei rounding under split purchases and consumption
    √ limits Owner withdrawals to historical assigned credit and never LP funds
    √ preserves old recipient credits when collection recipient or governance owner changes
    √ restores credit on failed BNB payout and rejects authorized recipient reentry
    √ separates the 30亿 reward budget from the 50亿 LP reserve and cannot reset reward funds
    √ rejects raw BNB deposits and LP execution without configured safety prerequisites
    √ disables LP execution after the bootstrap ratio changes until governance re-enables the checked route (42ms)
    √ bootstraps solely from 100 paid consumptions: 0.05 BNB with 25m ENCR (43ms)
    √ scales bootstrap tokens to the actual mixed-price 0.09 BNB batch rather than a fixed 25m (41ms)
    √ swaps and adds on an existing pair while preserving acquired token carry and reward balances (54ms)
    √ retains refunded BNB as LP-only carry and uses it in the next batch (52ms)
    √ rolls back failed router calls completely and retries the same funded batch exactly once (57ms)
    √ rejects guard failures, zero minima, stale deadlines and unprivileged execution (45ms)
    √ rejects a router reporting inconsistent token usage without spending any reserved funds
    √ blocks a role-authorized router from recursively executing another LP batch (49ms)
    √ closes zero-credit batches without inventing liquidity or giving Owner LP credit
    √ preserves historical lots, half-filled batches and reward budgets through UUPS upgrade

  OpenZeppelin UUPS implementation and real V2 storage validation
    √ validates GameRules and a distinct V2 with appended storage (112ms)
    √ validates EnergyCrystal and a distinct V2 with appended storage (122ms)
Warning: Potentially unsafe deployment of contracts/AICoreGame.sol:AICoreGame

    You are using the `unsafeAllow.external-library-linking` flag to include external libraries.
    Make sure you have manually checked that the linked libraries are upgrade safe.

Warning: Potentially unsafe deployment of contracts/test/UpgradeAuditV2.sol:CoreAuditV2

    You are using the `unsafeAllow.external-library-linking` flag to include external libraries.
    Make sure you have manually checked that the linked libraries are upgrade safe.

    √ validates AICoreGame and a distinct V2 with appended storage (78ms)
    √ validates AICoreArena and a distinct V2 with appended storage (121ms)
    √ validates GameTreasury and a distinct V2 with appended storage (164ms)
    √ validates PopulationManager and a distinct V2 with appended storage (100ms)
    √ validates AICoreMarket and a distinct V2 with appended storage (113ms)
    √ validates ChainlinkRandomSource and a distinct V2 with appended storage (87ms)
    √ rejects an incompatible V2 storage type and executes a compatible state-preserving proxy upgrade (212ms)
    √ detects an incompatible Core ERC-7201 namespace instead of treating its layout as empty (79ms)


  201 passing (13s)
  8 pending