// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

import {Test} from "forge-std/Test.sol";
import {ERC1155Holder} from "@openzeppelin/contracts/token/ERC1155/utils/ERC1155Holder.sol";
import {OGClubFurniture} from "src/OGClubFurniture.sol";
import {OGClubBox} from "src/OGClubBox.sol";
import {MockOG} from "src/mocks/MockOG.sol";

/// @dev Buyer contract that vetoes any forced open whose items do not include the item it wants.
contract PickyBuyer is ERC1155Holder {
    uint256 public wanted;
    bool public picky;

    function setWanted(uint256 id, bool picky_) external {
        wanted = id;
        picky = picky_;
    }

    function _check(uint256[] memory ids) internal view {
        if (!picky) return;
        bool found;
        for (uint256 i; i < ids.length; ++i) {
            if (ids[i] == wanted) found = true;
        }
        require(found, "picky buyer rejects this roll");
    }

    function onERC1155Received(address, address, uint256 id, uint256, bytes memory) public view override returns (bytes4) {
        uint256[] memory ids = new uint256[](1);
        ids[0] = id;
        _check(ids);
        return this.onERC1155Received.selector;
    }

    function onERC1155BatchReceived(address, address, uint256[] memory ids, uint256[] memory, bytes memory)
        public
        view
        override
        returns (bytes4)
    {
        _check(ids);
        return this.onERC1155BatchReceived.selector;
    }
}

/// @notice Fails on the current code: a pending purchase's outcome improves after another purchase sells out a cap.
contract DelayRerollTest is Test {
    MockOG internal token;
    OGClubFurniture internal furniture;
    OGClubBox internal box;
    PickyBuyer internal alice;
    address internal carol = makeAddr("carol");
    address internal dave = makeAddr("dave");
    address internal stranger = makeAddr("stranger");
    uint256 internal seasonId;

    uint256 constant COMMON = 1; // tier 0, weight 60, unlimited (fallback)
    uint256 constant LEGENDARY = 2; // tier 4, weight 10, unlimited
    uint256 constant BAIT = 3; // tier 1, weight 30, cap 1

    function setUp() public {
        vm.roll(100);
        vm.warp(1000);
        token = new MockOG(address(this));
        furniture = new OGClubFurniture(address(this), address(this));
        box = new OGClubBox(token, furniture, makeAddr("vault"), address(this));
        furniture.setMinter(address(box), true);
        OGClubBox.Entry[] memory entries = new OGClubBox.Entry[](3);
        entries[0] = OGClubBox.Entry(COMMON, 0, 60, 0);
        entries[1] = OGClubBox.Entry(LEGENDARY, 4, 10, 0);
        entries[2] = OGClubBox.Entry(BAIT, 1, 30, 1);
        seasonId = box.createSeason(100, 1000, 100_000, 0, COMMON, entries);
        alice = new PickyBuyer();
        for (uint256 i; i < 3; ++i) {
            address who = i == 0 ? address(alice) : i == 1 ? carol : dave;
            token.mint(who, 1000);
            vm.prank(who);
            token.approve(address(box), type(uint256).max);
        }
    }

    function tierOf(uint256 itemId) internal view returns (uint8) {
        OGClubBox.Entry[] memory entries = box.getEntries(seasonId);
        for (uint256 i; i < entries.length; ++i) {
            if (entries[i].itemId == itemId) return entries[i].tier;
        }
        revert("unknown item");
    }

    function seed(bytes32 randao, uint256 purchaseId) internal view returns (uint256) {
        return uint256(keccak256(abi.encode(randao, block.chainid, address(box), purchaseId, uint256(0))));
    }

    /// @dev Find a prevRandao under which, with the cap still open, Alice rolls Common, Carol rolls Legendary and
    ///      Dave rolls the capped Bait, while after Bait sells out Alice's roll re-maps to Legendary.
    function findRandao() internal view returns (bytes32 randao) {
        for (uint256 n; n < 50_000; ++n) {
            randao = keccak256(abi.encode("search", n));
            uint256 a = seed(randao, 1);
            uint256 c = seed(randao, 2);
            uint256 d = seed(randao, 3);
            bool aliceCommonThenLegendary = a % 100 < 60 && a % 70 >= 60;
            bool carolLegendaryFresh = c % 100 >= 60 && c % 100 < 70;
            bool daveBaitFresh = d % 100 >= 70;
            if (aliceCommonThenLegendary && carolLegendaryFresh && daveBaitFresh) return randao;
        }
        revert("no randao found");
    }

    // --- minimal RLP header encoder (14 fields, all empty except number and mixHash) ---
    function rlpUint(uint256 value) internal pure returns (bytes memory out) {
        if (value == 0) return hex"80";
        uint256 len;
        for (uint256 v = value; v != 0; v >>= 8) ++len;
        bytes memory raw = new bytes(len);
        for (uint256 i; i < len; ++i) raw[len - 1 - i] = bytes1(uint8(value >> (8 * i)));
        if (len == 1 && uint8(raw[0]) < 0x80) return raw;
        return bytes.concat(bytes1(uint8(0x80 + len)), raw);
    }

    function header(uint256 number, bytes32 randao) internal pure returns (bytes memory) {
        bytes memory payload;
        for (uint256 f; f < 14; ++f) {
            if (f == 8) payload = bytes.concat(payload, rlpUint(number));
            else if (f == 13) payload = bytes.concat(payload, hex"a0", randao);
            else payload = bytes.concat(payload, hex"80");
        }
        require(payload.length < 56, "short list expected");
        return bytes.concat(bytes1(uint8(0xc0 + payload.length)), payload);
    }

    function test_PendingRollMustNotImproveWhenAnotherPurchaseSellsOutACap() public {
        // Three one-box purchases in the same block share one prevRandao; ids 1, 2, 3.
        vm.prank(address(alice));
        uint256 pAlice = box.buy(seasonId, 1);
        vm.prank(carol);
        uint256 pCarol = box.buy(seasonId, 1);
        vm.prank(dave);
        uint256 pDave = box.buy(seasonId, 1);
        (,,, uint256 targetBlock,) = box.purchases(pAlice);

        bytes32 randao = findRandao();
        bytes memory hdr = header(targetBlock, randao);
        vm.roll(targetBlock + 1);
        vm.setBlockhash(targetBlock, keccak256(hdr));

        uint256 aliceBefore = box.previewOpen(pAlice, randao)[0];
        uint256 carolBefore = box.previewOpen(pCarol, randao)[0];
        assertEq(aliceBefore, COMMON, "Alice's fresh roll is Common");
        assertEq(carolBefore, LEGENDARY, "Carol's fresh roll is Legendary");
        assertEq(box.previewOpen(pDave, randao)[0], BAIT, "Dave's fresh roll is the capped Bait");

        // A stranger tries to force Alice's open now; her contract vetoes a Common roll.
        alice.setWanted(LEGENDARY, true);
        vm.prank(stranger);
        vm.expectRevert(bytes("picky buyer rejects this roll"));
        box.open(pAlice, hdr);

        // Alice opens Dave's purchase (anyone may), which sells out the Bait cap.
        vm.prank(address(alice));
        box.open(pDave, hdr);
        assertEq(box.minted(seasonId, BAIT), 1);

        uint256 aliceAfter = box.previewOpen(pAlice, randao)[0];
        uint256 carolAfter = box.previewOpen(pCarol, randao)[0];

        // Spec: "delaying never helps". A pending roll must never get better because someone else opened.
        assertLe(
            tierOf(aliceAfter),
            tierOf(aliceBefore),
            "pending roll improved by waiting for a cap to sell out (free re-roll)"
        );
        // And a third party opening an unrelated purchase must not take an uncapped item away from Carol.
        assertEq(carolAfter, carolBefore, "stranger's open of an unrelated purchase re-mapped Carol's roll");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

import {Test} from "forge-std/Test.sol";
import {ERC1155Holder} from "@openzeppelin/contracts/token/ERC1155/utils/ERC1155Holder.sol";
import {OGClubFurniture} from "src/OGClubFurniture.sol";
import {OGClubBox} from "src/OGClubBox.sol";
import {MockOG} from "src/mocks/MockOG.sol";

/// @dev A contract buyer that refuses delivery of anything but the Rare piece (item 2).
///      Because `open` reverts as a whole when the receiver rejects, the purchase stays
///      unopened and can be re-rolled later against a different cap state.
contract PickyBuyer is ERC1155Holder {
    OGClubBox public box;
    uint256 public wanted;

    constructor(OGClubBox box_, MockOG token_, uint256 wanted_) {
        box = box_;
        wanted = wanted_;
        token_.approve(address(box_), type(uint256).max);
    }

    function buy(uint256 seasonId, uint256 count) external returns (uint256) {
        return box.buy(seasonId, count);
    }

    // OpenZeppelin routes a one-element mintBatch through the single-item hook.
    function onERC1155Received(address, address, uint256 id, uint256, bytes memory) public view override returns (bytes4) {
        require(id == wanted, "picky: not the item I want");
        return this.onERC1155Received.selector;
    }

    function onERC1155BatchReceived(address, address, uint256[] memory ids, uint256[] memory, bytes memory)
        public
        view
        override
        returns (bytes4)
    {
        for (uint256 i; i < ids.length; ++i) {
            require(ids[i] == wanted, "picky: not the item I want");
        }
        return this.onERC1155BatchReceived.selector;
    }
}

contract SelectiveRerollTest is Test {
    MockOG internal token;
    OGClubFurniture internal furniture;
    OGClubBox internal box;
    address internal other = makeAddr("other");
    address internal vault = makeAddr("vault");
    uint256 internal seasonId;

    // Entries, in roll order: A common w10 cap0 | C common w80 cap1 | B rare w10 cap0.
    // Live total weight 100: roll <10 -> A, 10..89 -> C, 90..99 -> B (10% rare).
    // Once C is sold out total weight is 20: roll <10 -> A, 10..19 -> B (50% rare).
    uint256 internal constant A = 1;
    uint256 internal constant B = 2;
    uint256 internal constant C = 3;

    function setUp() public {
        vm.roll(100);
        vm.warp(1000);
        token = new MockOG(address(this));
        furniture = new OGClubFurniture(address(this), vault);
        box = new OGClubBox(token, furniture, vault, address(this));
        furniture.setMinter(address(box), true);
        OGClubBox.Entry[] memory entries = new OGClubBox.Entry[](3);
        entries[0] = OGClubBox.Entry(A, 0, 10, 0);
        entries[1] = OGClubBox.Entry(C, 0, 80, 1);
        entries[2] = OGClubBox.Entry(B, 2, 10, 0);
        seasonId = box.createSeason(100, 1000, 100_000, 0, A, entries);
        token.mint(other, 1_000_000 ether);
        vm.prank(other);
        token.approve(address(box), type(uint256).max);
    }

    function _seed(bytes32 randao, uint256 purchaseId) internal view returns (uint256) {
        return uint256(keccak256(abi.encode(randao, block.chainid, address(box), purchaseId, uint256(0))));
    }

    function _header(uint256 number, bytes32 randao) internal pure returns (bytes memory) {
        // Minimal RLP list: 8 empty strings, number, 4 empty strings, 32-byte mixHash.
        bytes memory payload;
        for (uint256 i; i < 8; ++i) {
            payload = bytes.concat(payload, hex"80");
        }
        // Canonical RLP integer: a single byte below 0x80 is its own encoding.
        if (number < 0x80) payload = bytes.concat(payload, bytes1(uint8(number)));
        else payload = bytes.concat(payload, bytes1(uint8(0x80 + 1)), bytes1(uint8(number)));
        for (uint256 i; i < 4; ++i) {
            payload = bytes.concat(payload, hex"80");
        }
        payload = bytes.concat(payload, hex"a0", randao);
        return bytes.concat(bytes1(uint8(0xc0 + payload.length)), payload);
    }

    function test_ReceiverRejectionLetsContractBuyerRerollIntoRare() public {
        PickyBuyer attacker = new PickyBuyer(box, token, B);
        token.mint(address(attacker), 1_000_000 ether);

        // Same block: both purchases share one target block and therefore one prevRandao.
        uint256 attackerPurchase = attacker.buy(seasonId, 1);
        vm.prank(other);
        uint256 otherPurchase = box.buy(seasonId, 1);
        (,,, uint256 targetBlock,) = box.purchases(attackerPurchase);
        assertLt(targetBlock, 256, "header helper encodes a one-byte number");

        // Find a prevRandao where the honest roll of the attacker is NOT the rare piece,
        // the other buyer's roll is the capped piece C, and the attacker's roll becomes B
        // once C is sold out. This is just a specific chain state, not a contrived one:
        // 80% of blocks sell C to the other buyer and half of those flip the attacker's roll.
        bytes32 randao;
        for (uint256 i; i < 10_000; ++i) {
            bytes32 candidate = keccak256(abi.encode("reroll", i));
            uint256 sa = _seed(candidate, attackerPurchase);
            uint256 so = _seed(candidate, otherPurchase);
            bool attackerHonestNotB = sa % 100 < 90;
            bool otherGetsC = so % 100 >= 10 && so % 100 < 90;
            bool attackerAfterIsB = sa % 20 >= 10;
            if (attackerHonestNotB && otherGetsC && attackerAfterIsB) {
                randao = candidate;
                break;
            }
        }
        assertTrue(randao != bytes32(0), "no suitable randao found");

        vm.roll(targetBlock + 1);
        bytes memory header = _header(targetBlock, randao);
        vm.setBlockhash(targetBlock, keccak256(header));

        // The honest outcome of the attacker's box, as the contract itself computes it.
        uint256[] memory honest = box.previewOpen(attackerPurchase, randao);
        assertTrue(honest[0] != B, "setup: honest roll must not be the rare piece");

        // 1. Attacker's receiver rejects the honest roll; the whole open reverts and nothing is settled.
        vm.expectRevert(bytes("picky: not the item I want"));
        box.open(attackerPurchase, header);
        (,,,, bool opened) = box.purchases(attackerPurchase);
        assertFalse(opened);

        // 2. Another purchase opens and sells out C.
        box.open(otherPurchase, header);
        assertEq(box.minted(seasonId, C), 1);

        // 3. Same purchase, same prevRandao, same header: the attacker now rolls the rare piece and accepts.
        uint256[] memory rerolled = box.previewOpen(attackerPurchase, randao);
        assertEq(rerolled[0], B, "setup: cap change must flip the attacker's roll");
        box.open(attackerPurchase, header);

        // A box must have exactly one outcome once its prevRandao is fixed. A contract buyer must not be
        // able to decline the first outcome and collect a better one from the same purchase.
        assertEq(
            furniture.balanceOf(address(attacker), B),
            0,
            "contract buyer re-rolled a rejected box into the rare piece"
        );
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

import {Test} from "forge-std/Test.sol";
import {OGClubFurniture} from "src/OGClubFurniture.sol";
import {OGClubBox} from "src/OGClubBox.sol";
import {MockOG} from "src/mocks/MockOG.sol";

/// @dev `buy` takes payment even when the box is not (or no longer) an authorized furniture minter,
///      so `open` cannot succeed. The payment is already with the vault and burn address, and once
///      256 blocks pass the purchase can only ever yield the fallback piece.
contract MinterGapTest is Test {
    MockOG internal token;
    OGClubFurniture internal furniture;
    OGClubBox internal box;
    address internal buyer = makeAddr("buyer");
    address internal vault = makeAddr("vault");
    uint256 internal seasonId;

    function setUp() public {
        vm.roll(100);
        vm.warp(1000);
        token = new MockOG(address(this));
        furniture = new OGClubFurniture(address(this), vault);
        box = new OGClubBox(token, furniture, vault, address(this));
        // Deliberately NOT calling furniture.setMinter(address(box), true): the documented
        // post-deploy step has not happened yet (or was revoked later).
        OGClubBox.Entry[] memory entries = new OGClubBox.Entry[](2);
        entries[0] = OGClubBox.Entry(1, 0, 50, 0);
        entries[1] = OGClubBox.Entry(2, 4, 50, 0);
        seasonId = box.createSeason(100 ether, 1000, 100_000, 5000, 1, entries);
        token.mint(buyer, 1_000_000 ether);
        vm.prank(buyer);
        token.approve(address(box), type(uint256).max);
    }

    function _header(uint256 number, bytes32 randao) internal pure returns (bytes memory) {
        // Minimal RLP list: 8 empty strings, number (one byte, < 256), 4 empty strings, 32-byte mixHash.
        bytes memory payload;
        for (uint256 i; i < 8; ++i) {
            payload = bytes.concat(payload, hex"80");
        }
        if (number < 0x80) payload = bytes.concat(payload, bytes1(uint8(number)));
        else payload = bytes.concat(payload, bytes1(uint8(0x80 + 1)), bytes1(uint8(number)));
        for (uint256 i; i < 4; ++i) {
            payload = bytes.concat(payload, hex"80");
        }
        payload = bytes.concat(payload, hex"a0", randao);
        return bytes.concat(bytes1(uint8(0xc0 + payload.length)), payload);
    }

    function test_BuyMustRevertWhileBoxCannotMint() public {
        assertFalse(furniture.minters(address(box)));
        uint256 vaultBefore = token.balanceOf(vault);

        // Expected: the sale is refused because no purchase made now can be opened.
        // Actual on current code: buy succeeds, 50 tokens are burned and 50 go to the vault.
        vm.prank(buyer);
        vm.expectRevert();
        box.buy(seasonId, 1);

        assertEq(token.balanceOf(vault), vaultBefore, "vault must not be paid for an unopenable box");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

import {Test} from "forge-std/Test.sol";
import {ERC1155Holder} from "@openzeppelin/contracts/token/ERC1155/utils/ERC1155Holder.sol";
import {OGClubFurniture} from "src/OGClubFurniture.sol";
import {OGClubBox} from "src/OGClubBox.sol";
import {MockOG} from "src/mocks/MockOG.sol";

/// @dev Minimal RLP encoder for a synthetic header whose field 8 is the number and field 13 the prevRandao.
library Rlp {
    function uintBytes(uint256 value) internal pure returns (bytes memory result) {
        uint256 length;
        for (uint256 n = value; n != 0; n >>= 8) ++length;
        result = new bytes(length);
        for (uint256 i; i < length; ++i) result[length - 1 - i] = bytes1(uint8(value >> (8 * i)));
    }

    function str(bytes memory value) internal pure returns (bytes memory) {
        if (value.length == 1 && uint8(value[0]) < 0x80) return value;
        return bytes.concat(bytes1(uint8(0x80 + value.length)), value);
    }

    function header(uint256 number, bytes32 randao) internal pure returns (bytes memory) {
        bytes memory payload;
        for (uint256 i; i < 16; ++i) {
            bytes memory field = i == 8 ? uintBytes(number) : i == 13 ? abi.encodePacked(randao) : uintBytes(i);
            payload = bytes.concat(payload, str(field));
        }
        return bytes.concat(bytes1(uint8(0xc0 + payload.length)), payload);
    }
}

contract CapOrderRerollTest is Test, ERC1155Holder {
    MockOG token;
    OGClubFurniture furniture;
    OGClubBox box;
    address attacker = makeAddr("attacker");
    address victim = makeAddr("victim");
    uint256 season;

    function setUp() public {
        vm.roll(100);
        vm.warp(1000);
        token = new MockOG(address(this));
        furniture = new OGClubFurniture(address(this), address(this));
        box = new OGClubBox(token, furniture, makeAddr("vault"), address(this));
        furniture.setMinter(address(box), true);
        OGClubBox.Entry[] memory entries = new OGClubBox.Entry[](3);
        entries[0] = OGClubBox.Entry(1, 0, 2, 0); // Common, unlimited fallback
        entries[1] = OGClubBox.Entry(2, 2, 1, 1); // Rare, cap 1
        entries[2] = OGClubBox.Entry(3, 4, 1, 1); // Legendary, cap 1
        season = box.createSeason(1, 1000, 100_000, 0, 1, entries);
        token.mint(attacker, 100);
        token.mint(victim, 100);
        vm.prank(attacker);
        token.approve(address(box), type(uint256).max);
        vm.prank(victim);
        token.approve(address(box), type(uint256).max);
    }

    /// @notice An opener must not be able to upgrade their own roll by first opening someone else's purchase.
    ///         Opening other purchases may only consume caps (degrading a roll to the fallback), never remap
    ///         the attacker's fixed seed onto a better item.
    function test_OpeningOrderCannotUpgradeOwnRoll() public {
        vm.prank(attacker);
        uint256 own = box.buy(season, 1);
        vm.prank(victim);
        uint256 other = box.buy(season, 1);
        (,,, uint256 targetBlock,) = box.purchases(own);
        vm.roll(targetBlock + 1);

        for (uint256 i; i < 400; ++i) {
            bytes32 randao = keccak256(abi.encode("prevRandao", i));
            bytes memory header = Rlp.header(targetBlock, randao);
            vm.setBlockhash(targetBlock, keccak256(header));

            uint256 honest = box.previewOpen(own, randao)[0];
            uint256 snapshot = vm.snapshotState();
            box.open(other, header); // permissionless: the attacker opens the victim's purchase first
            uint256 afterOther = box.previewOpen(own, randao)[0];
            box.open(own, header);
            assertEq(furniture.balanceOf(attacker, afterOther), 1);
            vm.revertToState(snapshot);

            assertTrue(
                afterOther == honest || afterOther == 1,
                string.concat(
                    "attacker upgraded own roll by opening another purchase first: honest=",
                    vm.toString(honest),
                    " afterOther=",
                    vm.toString(afterOther),
                    " randao index=",
                    vm.toString(i)
                )
            );
        }
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

import {Test} from "forge-std/Test.sol";
import {ERC1155Holder} from "@openzeppelin/contracts/token/ERC1155/utils/ERC1155Holder.sol";
import {OGClubFurniture} from "src/OGClubFurniture.sol";
import {OGClubBox} from "src/OGClubBox.sol";
import {MockOG} from "src/mocks/MockOG.sol";

/// @dev Buyer contract that vetoes any forced open whose items do not include the item it wants.
contract PickyBuyer is ERC1155Holder {
    uint256 public wanted;
    bool public picky;

    function setWanted(uint256 id, bool picky_) external {
        wanted = id;
        picky = picky_;
    }

    function _check(uint256[] memory ids) internal view {
        if (!picky) return;
        bool found;
        for (uint256 i; i < ids.length; ++i) {
            if (ids[i] == wanted) found = true;
        }
        require(found, "picky buyer rejects this roll");
    }

    function onERC1155Received(address, address, uint256 id, uint256, bytes memory) public view override returns (bytes4) {
        uint256[] memory ids = new uint256[](1);
        ids[0] = id;
        _check(ids);
        return this.onERC1155Received.selector;
    }

    function onERC1155BatchReceived(address, address, uint256[] memory ids, uint256[] memory, bytes memory)
        public
        view
        override
        returns (bytes4)
    {
        _check(ids);
        return this.onERC1155BatchReceived.selector;
    }
}

/// @notice Fails on the current code: a pending purchase's outcome improves after another purchase sells out a cap.
contract DelayRerollTest is Test {
    MockOG internal token;
    OGClubFurniture internal furniture;
    OGClubBox internal box;
    PickyBuyer internal alice;
    address internal carol = makeAddr("carol");
    address internal dave = makeAddr("dave");
    address internal stranger = makeAddr("stranger");
    uint256 internal seasonId;

    uint256 constant COMMON = 1; // tier 0, weight 60, unlimited (fallback)
    uint256 constant LEGENDARY = 2; // tier 4, weight 10, unlimited
    uint256 constant BAIT = 3; // tier 1, weight 30, cap 1

    function setUp() public {
        vm.roll(100);
        vm.warp(1000);
        token = new MockOG(address(this));
        furniture = new OGClubFurniture(address(this), address(this));
        box = new OGClubBox(token, furniture, makeAddr("vault"), address(this));
        furniture.setMinter(address(box), true);
        OGClubBox.Entry[] memory entries = new OGClubBox.Entry[](3);
        entries[0] = OGClubBox.Entry(COMMON, 0, 60, 0);
        entries[1] = OGClubBox.Entry(LEGENDARY, 4, 10, 0);
        entries[2] = OGClubBox.Entry(BAIT, 1, 30, 1);
        seasonId = box.createSeason(100, 1000, 100_000, 0, COMMON, entries);
        alice = new PickyBuyer();
        for (uint256 i; i < 3; ++i) {
            address who = i == 0 ? address(alice) : i == 1 ? carol : dave;
            token.mint(who, 1000);
            vm.prank(who);
            token.approve(address(box), type(uint256).max);
        }
    }

    function tierOf(uint256 itemId) internal view returns (uint8) {
        OGClubBox.Entry[] memory entries = box.getEntries(seasonId);
        for (uint256 i; i < entries.length; ++i) {
            if (entries[i].itemId == itemId) return entries[i].tier;
        }
        revert("unknown item");
    }

    function seed(bytes32 randao, uint256 purchaseId) internal view returns (uint256) {
        return uint256(keccak256(abi.encode(randao, block.chainid, address(box), purchaseId, uint256(0))));
    }

    /// @dev Find a prevRandao under which, with the cap still open, Alice rolls Common, Carol rolls Legendary and
    ///      Dave rolls the capped Bait, while after Bait sells out Alice's roll re-maps to Legendary.
    function findRandao() internal view returns (bytes32 randao) {
        for (uint256 n; n < 50_000; ++n) {
            randao = keccak256(abi.encode("search", n));
            uint256 a = seed(randao, 1);
            uint256 c = seed(randao, 2);
            uint256 d = seed(randao, 3);
            bool aliceCommonThenLegendary = a % 100 < 60 && a % 70 >= 60;
            bool carolLegendaryFresh = c % 100 >= 60 && c % 100 < 70;
            bool daveBaitFresh = d % 100 >= 70;
            if (aliceCommonThenLegendary && carolLegendaryFresh && daveBaitFresh) return randao;
        }
        revert("no randao found");
    }

    // --- minimal RLP header encoder (14 fields, all empty except number and mixHash) ---
    function rlpUint(uint256 value) internal pure returns (bytes memory out) {
        if (value == 0) return hex"80";
        uint256 len;
        for (uint256 v = value; v != 0; v >>= 8) ++len;
        bytes memory raw = new bytes(len);
        for (uint256 i; i < len; ++i) raw[len - 1 - i] = bytes1(uint8(value >> (8 * i)));
        if (len == 1 && uint8(raw[0]) < 0x80) return raw;
        return bytes.concat(bytes1(uint8(0x80 + len)), raw);
    }

    function header(uint256 number, bytes32 randao) internal pure returns (bytes memory) {
        bytes memory payload;
        for (uint256 f; f < 14; ++f) {
            if (f == 8) payload = bytes.concat(payload, rlpUint(number));
            else if (f == 13) payload = bytes.concat(payload, hex"a0", randao);
            else payload = bytes.concat(payload, hex"80");
        }
        require(payload.length < 56, "short list expected");
        return bytes.concat(bytes1(uint8(0xc0 + payload.length)), payload);
    }

    function test_PendingRollMustNotImproveWhenAnotherPurchaseSellsOutACap() public {
        // Three one-box purchases in the same block share one prevRandao; ids 1, 2, 3.
        vm.prank(address(alice));
        uint256 pAlice = box.buy(seasonId, 1);
        vm.prank(carol);
        uint256 pCarol = box.buy(seasonId, 1);
        vm.prank(dave);
        uint256 pDave = box.buy(seasonId, 1);
        (,,, uint256 targetBlock,) = box.purchases(pAlice);

        bytes32 randao = findRandao();
        bytes memory hdr = header(targetBlock, randao);
        vm.roll(targetBlock + 1);
        vm.setBlockhash(targetBlock, keccak256(hdr));

        uint256 aliceBefore = box.previewOpen(pAlice, randao)[0];
        uint256 carolBefore = box.previewOpen(pCarol, randao)[0];
        assertEq(aliceBefore, COMMON, "Alice's fresh roll is Common");
        assertEq(carolBefore, LEGENDARY, "Carol's fresh roll is Legendary");
        assertEq(box.previewOpen(pDave, randao)[0], BAIT, "Dave's fresh roll is the capped Bait");

        // A stranger tries to force Alice's open now; her contract vetoes a Common roll.
        alice.setWanted(LEGENDARY, true);
        vm.prank(stranger);
        vm.expectRevert(bytes("picky buyer rejects this roll"));
        box.open(pAlice, hdr);

        // Alice opens Dave's purchase (anyone may), which sells out the Bait cap.
        vm.prank(address(alice));
        box.open(pDave, hdr);
        assertEq(box.minted(seasonId, BAIT), 1);

        uint256 aliceAfter = box.previewOpen(pAlice, randao)[0];
        uint256 carolAfter = box.previewOpen(pCarol, randao)[0];

        // Spec: "delaying never helps". A pending roll must never get better because someone else opened.
        assertLe(
            tierOf(aliceAfter),
            tierOf(aliceBefore),
            "pending roll improved by waiting for a cap to sell out (free re-roll)"
        );
        // And a third party opening an unrelated purchase must not take an uncapped item away from Carol.
        assertEq(carolAfter, carolBefore, "stranger's open of an unrelated purchase re-mapped Carol's roll");
    }
}