CONTRACTS: Sorphera Passport - buy 12 paid tickets, earn 1 free

Continue the EXISTING project: https://github.com/identity-md-launches/launch-961-build-sorphera-smart-contracts

Start from latest main after PR #8; preserve newer work.

Read docs/PASSPORT-HANDOFF.md and current contracts/tests. These rules settle its finality/refund questions.

ONE Contracts task: implement/test rewards, regenerate interfaces and provide a handoff. No website work. Never import simulated browser Passport data as real entitlements.

1. PRODUCT RULES

One qualifying paid ticket earns one stamp. Every 12 stamps earns one free entry. Carry remainders across purchases, weeks and ETH/NFT games. No expiry, weekly cap, enrollment, NFT, token, tier, streak or transferable rewards.

Use one positive, immutable qualifying ticket price set for the deployment; local fixtures use 0.005 ETH. Production price remains a pre-deployment owner input. Earning/redemption requires the round's frozen price to equal it. Other-priced rounds are ineligible; cheap purchases cannot earn expensive entries. No later admin repricing of rewards.

Only fully paid eligible tickets count; rewards earn no stamps. No admin mint or discretionary grants. Transaction splitting cannot change rewards; wallet splitting cannot increase them.

Boundaries: 11+1 => 1 reward/0 stamps; 11+3 => 1/2; 24 => 2/0. Redemption leaves carried stamps intact.

2. FINALITY WITHOUT REWARD DEBT

Paid purchases remain pending until THEIR OWN round reaches Won or Rolled. For this version, cutoff, block confirmations, an accepted VRF request or an unfinished NFT tie-break are insufficient. Cancelled/refunded rounds earn zero. A Rolled round counts once; its old tickets do not enter later draws. Indefinitely pending rounds stay pending for rewards.

Credit each wallet/game/round at most once through bounded, idempotent finalization. Permissionless processing may credit only the rightful wallet. Never iterate every player or an entire wallet history. Allow bounded finalization alongside redemption where practical to avoid requiring a separate user transaction.

Derive rewards/remainders from cumulative finalized paid counts, independent of processing order. Never trust client counts or add refund clawbacks/reward debt. Preserve oracle policy.

3. REDEMPTION

One earned reward creates one zero-entry-price ticket in a qualifying open ETH or NFT round. No additional purchase is required; gas still applies. Support free-only redemption and an atomic mixed paid/reward batch matching the existing basket. Preserve ordinary paid-buy compatibility where practical.

Validate balance, owner, picks, game/round, chain, sales pause, start and strict block.timestamp < cutoff, with existing relevant launch/dependency guards. Reverts preserve state. Consume credit atomically; prevent overspending, replay, reentrancy and double processing. Helpers must not own player tickets. Avoid delegated signatures.

Free entries join the same matching index and have equal winning-number eligibility, ETH share per matching ticket, NFT tie-break chance and winner claim rights. Retain duplicate combinations, unique IDs across all entries, independent NFT tie randomness and immutable accepted requests.

4. ACCOUNTING AND CANCELLATION

Track paid, reward and total entries separately. Trace all uses of sold, zero-ticket checks and denominators; do not globally substitute paid counts for total entries.

Keep fees at 10% of actual paid ETH and the 90% acquisition allocation. Free entries create no revenue, fees, budget or extra FWA pulls. No treasury subsidy or fixed cash-value promise. Charge only paid entries. Free-only batches pay zero; do not fake funding to pass vault checks.

CRITICAL: _cancel currently uses r.sold as its refund divisor, and entitlement is shared by ETH, FWA token and exceptional NFT claims. Merely inserting free tickets would dilute paid refunds and allocate them cancellation proceeds.

Separate winning eligibility from cancellation eligibility:

• Won: paid/reward winning tickets share normal prize rights, including existing associated FWA token and late-asset entitlements.
• Cancelled: only the entitled PAID-ticket cohort shares the recovery pool. Reward tickets get NO cancellation cash, FWA tokens, late-recovery shares or exceptional NFT release votes.
• Restore each reward redeemed in a cancelled round exactly once to its original owner. Restoration earns no stamp and leaves no active entry. Losing/rolled-over entries are not restored; no ticket may both win and regain its reward.

Handle reward-only rounds, zero paid refund recipients, carryover, dust and late ETH/token/NFT arrivals without division by zero, orphaned funds, unpaid liabilities or operator windfalls. Preserve legitimate group/origin-round rights. Where zero-recipient recovery requires routing, implement/document same-game carry-forward for this new deployment, including later recoveries; no owner sweep.

Update liabilities, claims, vault/helper denominators and events consistently. Cancellation payouts remain shares of actual recoveries, not a new guaranteed full-price refund. State and test the invariants.

5. INTERFACES AND HANDOFF

Expose authoritative views/events for qualifying price, paid/reward/total counts, wallet pending/finalized credit, stamps, available rewards, processed rounds, redemptions and restorations. Use bounded views/indexed events, not unbounded history scans. Distinguish paid purchases from reward issuance; include owner/game/round/ticket.

Supply example reads/calls for finalization, redemption and restoration, with confirmation/reorg handling. Optimistic UI state is not spendable authority.

Regenerate canonical ABIs using the permitted workflow. Document compatibility/deployment changes and required hash regeneration; never falsify protected release hashes or activate the existing site's writes. UI wiring is a later Website task.

Update PASSPORT-HANDOFF.md with rules, accounting, ABI changes and customer-copy implications: "Rewards become available after the qualifying round completes. A cancelled reward entry returns your free ticket."

6. VERIFICATION

Add meaningful unit, fuzz/invariant and integration coverage:

• Thresholds/remainders, batch/order equivalence, mixed games, price exclusion.
• Pending/Won/Rolled/Cancelled finality, duplicate finalization, wallet isolation.
• Free-only/mixed batches, cutoff/pause, invalid picks, insufficient credits, reentrancy and failure rollback.
• Paid/reward winners and NFT ties; no recursive stamp earning.
• One-time cancellation restoration; no free-ticket recovery/voting rights.
• Zero paid recipients, carryover and late ETH/token/NFT recoveries.
• Bounded gas as history grows; rewards/liabilities cannot be inflated. Include a regression exposing the all-ticket refund-divisor error when free entries are introduced.

Run build/format/contract suites and relevant fork/tooling regressions. Pin inputs; distinguish simulated callback