@1aboveio/skills 0.19.3 → 0.20.2

package/skills/payment/tld-detection/references/terminology.md

@@ -0,0 +1,69 @@
+# Terminology
+
+Use these terms in TLD reports. Read before writing. After writing, run
+the proofread in `SKILL.md`.
+
+TLD in this skill is **transaction laundering**. Spell it out on first
+use. It is not a top-level domain.
+
+## Canonical glossary
+
+| English | Chinese | Do not write |
+|---|---|---|
+| TLD (transaction laundering) | 交易清洗 / TLD | 把 TLD 写成域名；洗钱结案 |
+| potential TLD currency-amount pair | 潜在 TLD 币种金额对 | 已确认 TLD；TLD 商户 |
+| cluster (report section) | 币种金额对 | 客户簇；客群；分群结果 |
+| anchor detection | 锚点识别 | 客户聚类（对业务读者） |
+| currency-amount-pair | 币种金额对 | 金额币种对；金额对；price point（作指标名时） |
+| descriptor partition | descriptor 分区 | 客群；BIN 国家分区 |
+| BIN-country attribution component | BIN 国家归因组件 | 客户国家；成员分区 |
+| geometric anchor family | 币种金额对 | 阶梯（业务报告中）；价格带；SKU |
+| stuffing | 掺量 | 注水（可括注一次）；corridor |
+| MCC miscoding | MCC 错配 | 改 MCC；纠正 MCC |
+| descriptor | descriptor / 账单描述 | 商户名（指 descriptor 时） |
+| baseline | 基线 | 对照组（可括注）；everything else |
+| all authorization attempts | 全部授权尝试 | U（业务报告中）；原始全量 |
+| US-BIN | US BIN / 美国发卡 | 美国交易（指卡BIN时） |
+| attempt | 授权尝试 | 交易（指授权行时） |
+| approval | 授权成功 | 批准 |
+| auth rate | 授权成功率 | 转化率 |
+| suspected fraud | 疑似欺诈 | 已确认欺诈；正文里写 D102（表内代码可留） |
+| BIN country / issuer country | 发卡行国家 / BIN 国家 | 客户国家；收货国；发卡国 |
+| cluster composition by BIN country | BIN 国家占 Cluster | 客户国家占比 |
+| descriptor-country slice coverage | Cluster 占 Descriptor 对应 BIN 国家 | BIN 国家风险率；国家命中率 |
+| exact single-country standout | 100% 单一 BIN 国家 standout | 高国家占比；接近 100% |
+| BIN-country local hour | BIN 国家当地小时 | 客户所在地时间；统一美国东部时间 |
+| this analysis window | 当前分析时段内 | 本窗口 |
+| MCC vs descriptor | MCC 与 descriptor 合理性 | 纠正 MCC；改 MCC |
+| verdict | 结论 | 长文综述（作结论部分时） |
+| High / Medium / Low risk | 高风险 / 中风险 / 低风险 | Supported；Weak；Ladder only；已确认 TLD |
+| risk exposure | 风险敞口 | 已确认 TLD 影响；定罪金额 |
+
+Keep proper nouns: Visa, MasterCard, BIN, IIN, MCC, MID, Worldpay,
+Pazien, Order ID, descriptor. Tables may show response codes; prose uses
+疑似欺诈 / suspected fraud.
+
+## Axis and UI
+
+- Amount axes name the **original** currency of that cluster
+  (`授权尝试金额 USD`, `授权尝试金额 EUR`). Do not mix currencies on one
+  axis.
+- Date charts use each series' share of attempts by UTC transaction date.
+- Time charts use each BIN country's local hour, falling back to UTC when no
+  timezone is configured. Normalize Cluster and Baseline independently.
+- HTML footer: data-source filenames only. No skill name.
+
+## Banned strings (grep after writing)
+
+Chinese: `走廊`, `杠杆`, `转化率`, `赋能`, `抓手`, `闭环`, `打法`,
+`本窗口`, `已确认 TLD`, `已确认交易清洗`, `洗钱`, `发卡国`, `客群运营`,
+`客户簇`, `金额币种对`
+
+English: `confirmed laundering`, `confirmed TLD`, `money laundering`,
+`SAR`, `file a SAR`, `top-level domain`, `customer country`,
+`conversion rate` (when meaning auth rate), `corridor`, `price band`
+(as the cluster name)
+
+`洗钱` is banned as a finding. If a source document uses the legal term,
+quote it in supporting evidence and keep the report on potential TLD
+currency-amount pairs.

package/skills/payment/tld-detection/references/workflow.md

@@ -0,0 +1,78 @@
+# Workflow detail
+
+SKILL.md is the index. This file is the procedure those steps run.
+
+## Input
+
+Typical file: `Authorizations_*.csv`. Grain: **one authorization attempt**.
+
+Amount, currency, and descriptor columns are required. BIN/issuer country,
+issuing bank, MCC, and response are expected for characteristics; a missing
+optional column is captioned. Missing descriptor values enter an explicit
+partition bucket; missing BIN-country values enter a reporting bucket after
+membership is frozen. Do not drop those rows.
+
+Settlements and chargebacks are not the clustering universe. Do not join
+them into `U`. If only settlements exist, stop and say the clustering
+grain is auth attempts.
+
+## Column aliases
+
+Use the first present name. Record the alias actually used.
+
+| Role | Common names |
+|---|---|
+| Time | `Timestamp`, `Auth timestamp`, `Transaction date` |
+| Amount | `Amount`, `Transaction amount`, `Requested amount` |
+| Currency | `Currency`, `Transaction currency`, `Auth currency` |
+| BIN / issuer country | `BIN country`, `IIN country`, `Issuer country`, `Card country` |
+| Issuing bank | `Issuing bank`, `Issuer`, `Issuer name`, `Bank name` |
+| Descriptor | `Billing descriptor`, `Descriptor`, `Soft descriptor`, `Submerchant`, `DBA` |
+| MCC | `MCC`, `Merchant category code` |
+| Response | `Response code`, `Response message`, `Auth response` |
+| Identity | `Order ID`, `Transaction ID`, `Auth ID` |
+| Card | `IIN`, `BIN`, `Payment method`, `Card type`, masked `Account` |
+
+Portfolio constants (MID, acquirer, entry method) are recorded once. They
+are not partition or clustering keys.
+
+## Window
+
+Default: min→max of the time field on the **cleaned** universe. If the user
+names a week or month, cut there and state it.
+
+## Response classes
+
+Recompute from the file. Pazien-style defaults when those codes exist:
+
+| Class | Typical |
+|---|---|
+| Approval | A001 / message contains approval |
+| Suspected fraud | D102 / message contains suspected fraud |
+| Other decline | remaining non-approvals |
+
+Suspected-fraud decline ≠ confirmed fraud loss. Do not treat D102 as a
+positive label for `fraud-analysis`.
+
+## What this skill is looking for
+
+Transaction laundering in this book usually shows up as:
+
+1. **MCC miscoding** — different kinds of goods mixed under one “normal” MCC
+2. **Descriptor mixing** — several customer types share a billing name, or
+   one TLD customer is split across several descriptors
+3. **Stuffing / 掺量** — a geometric amount ladder riding the same MCC as
+   legitimate traffic
+
+Descriptor defines the initial partition, while BIN country and MCC do not.
+Geometrically related currency-amount anchors inside each descriptor define
+membership. BIN country and issuing bank are reported only after membership
+is frozen.
+
+## Order that must not move
+
+Clean → descriptor partition → currency-amount pairs → same-descriptor baseline → decide → report.
+
+Comparison features must not create a cluster that amount detection did not
+find. Decision does not add evidence; it only writes the ≤3-sentence
+conclusion.

package/skills/payment/tld-detection/scripts/detect_ladders.py

@@ -0,0 +1,390 @@
+#!/usr/bin/env python3
+"""Detect exact currency-amount-pair ladders with absolute rung residuals."""
+from __future__ import annotations
+
+import argparse
+import csv
+import json
+import re
+from collections import Counter, defaultdict
+from dataclasses import dataclass
+from decimal import Decimal
+from pathlib import Path
+from typing import Iterable, Mapping, Sequence
+
+
+Pair = tuple[str, Decimal]
+Partition = str
+CLUSTER_MULTIPLIER = Decimal("2")
+
+
+@dataclass(frozen=True)
+class LadderConfig:
+    absolute_caps: Mapping[str, Decimal]
+    min_levels: int = 3
+    min_cluster_attempts: int = 100
+    multi_anchor_min_attempts: int = 24
+
+
+def _rank(keys: Iterable[Pair], counts: Mapping[Pair, int]) -> list[Pair]:
+    return sorted(keys, key=lambda key: (-counts[key], key[1], key[0]))
+
+
+def _residual(lower: Pair, upper: Pair, multiplier: Decimal) -> Decimal:
+    return abs(upper[1] - lower[1] * multiplier)
+
+
+def _expand_levels(
+    seed: Pair,
+    multiplier: Decimal,
+    available: set[Pair],
+    counts: Mapping[Pair, int],
+    cap: Decimal,
+    multi_anchor_min_attempts: int,
+) -> dict[int, set[Pair]]:
+    """Expand from a seed; every retained key is an explicit exact anchor."""
+    levels: dict[int, set[Pair]] = {0: {seed}}
+    claimed = {seed}
+    for direction in (1, -1):
+        previous = {seed}
+        for step in range(1, 21):
+            if direction == 1:
+                candidates = {
+                    candidate
+                    for candidate in available - claimed
+                    if candidate[0] == seed[0]
+                    and any(_residual(anchor, candidate, multiplier) <= cap for anchor in previous)
+                }
+            else:
+                candidates = {
+                    candidate
+                    for candidate in available - claimed
+                    if candidate[0] == seed[0]
+                    and any(_residual(candidate, anchor, multiplier) <= cap for anchor in previous)
+                }
+            if not candidates:
+                break
+
+            def candidate_residual(candidate: Pair) -> Decimal:
+                if direction == 1:
+                    return min(_residual(anchor, candidate, multiplier) for anchor in previous)
+                return min(_residual(candidate, anchor, multiplier) for anchor in previous)
+
+            primary = min(candidates, key=lambda candidate: (-counts[candidate], candidate_residual(candidate), candidate[1]))
+            next_level = {primary} | {
+                candidate for candidate in candidates if counts[candidate] >= multi_anchor_min_attempts
+            }
+            levels[direction * step] = next_level
+            claimed.update(next_level)
+            previous = next_level
+    return levels
+
+
+def _fit_residual(levels: Mapping[int, set[Pair]], multiplier: Decimal) -> Decimal:
+    total = Decimal("0")
+    for level, anchors in levels.items():
+        if level > 0:
+            total += sum(min(_residual(lower, anchor, multiplier) for lower in levels[level - 1]) for anchor in anchors)
+        elif level < 0:
+            total += sum(min(_residual(anchor, upper, multiplier) for upper in levels[level + 1]) for anchor in anchors)
+    return total
+
+
+def detect_ladders(
+    counts: Mapping[Pair, int], universe_count: int, config: LadderConfig
+) -> tuple[list[dict[str, object]], dict[str, object]]:
+    """Return disjoint ladders and deterministic threshold metadata."""
+    if universe_count <= 0:
+        raise ValueError("universe_count must be positive")
+    normalized = Counter({(currency.upper(), Decimal(amount)): count for (currency, amount), count in counts.items()})
+    high_threshold = max(30, 0.005 * universe_count)
+    rung_threshold = max(5, 0.001 * universe_count)
+    ranked = _rank(normalized, normalized)
+    global_top = set(ranked[:25])
+    by_currency: dict[str, list[Pair]] = defaultdict(list)
+    for key in normalized:
+        by_currency[key[0]].append(key)
+    high = {key for key, count in normalized.items() if count >= high_threshold} | global_top
+    for currency, keys in by_currency.items():
+        currency_top = _rank(keys, normalized)[:10]
+        high.update(key for key in currency_top if normalized[key] >= 30)
+
+    rung_pool = {key for key, count in normalized.items() if count >= rung_threshold}
+    rung_currencies = {currency for currency, _ in rung_pool}
+    missing_caps = sorted(rung_currencies - set(config.absolute_caps))
+    if missing_caps:
+        raise ValueError(f"missing absolute residual cap for rung-pool currencies: {', '.join(missing_caps)}")
+    unused = set(rung_pool)
+    found: list[dict[str, object]] = []
+    below_threshold: dict[frozenset[Pair], dict[str, object]] = {}
+    for seed in _rank(rung_pool, normalized):
+        if seed not in unused:
+            continue
+        candidates: list[tuple[tuple[object, ...], dict[int, set[Pair]], Decimal, Decimal]] = []
+        for multiplier in (CLUSTER_MULTIPLIER,):
+            cap = config.absolute_caps[seed[0]]
+            levels = _expand_levels(
+                seed,
+                multiplier,
+                unused,
+                normalized,
+                cap,
+                config.multi_anchor_min_attempts,
+            )
+            level_count = len(levels)
+            if level_count < max(3, config.min_levels):
+                continue
+            family = set().union(*levels.values())
+            fit_residual = _fit_residual(levels, multiplier)
+            score = (
+                level_count,
+                sum(normalized[key] for key in family),
+                -fit_residual,
+            )
+            candidates.append((score, levels, multiplier, fit_residual))
+        if not candidates:
+            continue
+        _, levels, multiplier, fit_residual = max(candidates, key=lambda item: item[0])
+        family = set().union(*levels.values())
+        candidate = {
+            "seed": seed,
+            "multiplier": multiplier,
+            "levels": levels,
+            "pairs": family,
+            "rule": "adjacent-absolute-residual",
+            "absolute_cap": config.absolute_caps[seed[0]],
+            "fit_residual": fit_residual,
+            "multi_anchor_levels": {level: anchors for level, anchors in levels.items() if len(anchors) > 1},
+            "alternatives": {},
+        }
+        family_attempts = sum(normalized[key] for key in family)
+        if family_attempts < config.min_cluster_attempts:
+            below_threshold.setdefault(frozenset(family), {**candidate, "attempts": family_attempts})
+            continue
+        found.append(candidate)
+        unused -= family
+
+    found.sort(key=lambda cluster: -sum(normalized[key] for key in cluster["pairs"]))
+    for index, cluster in enumerate(found, 1):
+        cluster["id"] = f"C{index}"
+    metadata = {
+        "method": "adjacent-absolute-residual",
+        "absolute_caps": dict(config.absolute_caps),
+        "high": high_threshold,
+        "rung": rung_threshold,
+        "high_pairs": _rank(high, normalized),
+        "rung_pool_size": len(rung_pool),
+        "pair_count": len(normalized),
+        "below_threshold": sorted(below_threshold.values(), key=lambda item: (-item["attempts"], item["seed"])),
+    }
+    return found, metadata
+
+
+def detect_partitioned_ladders(
+    entries: Iterable[tuple[Partition, Pair]],
+    config: LadderConfig,
+) -> tuple[Counter[tuple[Partition, Pair]], list[dict[str, object]], dict[str, object]]:
+    """Detect ladders independently inside frozen descriptor partitions."""
+    counts: Counter[tuple[Partition, Pair]] = Counter(entries)
+    partition_counts: Counter[Partition] = Counter()
+    pair_counts: dict[Partition, Counter[Pair]] = defaultdict(Counter)
+    for (partition, pair), count in counts.items():
+        partition_counts[partition] += count
+        pair_counts[partition][pair] += count
+
+    found: list[dict[str, object]] = []
+    partition_metadata: dict[Partition, dict[str, object]] = {}
+    high_entries: list[dict[str, object]] = []
+    for partition in sorted(partition_counts):
+        ladders, metadata = detect_ladders(pair_counts[partition], partition_counts[partition], config)
+        partition_metadata[partition] = metadata
+        for ladder in ladders:
+            ladder["partition"] = partition
+            ladder["partition_attempts"] = partition_counts[partition]
+            found.append(ladder)
+        for pair in metadata["high_pairs"]:
+            high_entries.append(
+                {
+                    "partition": partition,
+                    "pair": pair,
+                    "attempts": pair_counts[partition][pair],
+                    "partition_attempts": partition_counts[partition],
+                }
+            )
+
+    found.sort(key=lambda ladder: -sum(counts[(ladder["partition"], pair)] for pair in ladder["pairs"]))
+    for index, ladder in enumerate(found, 1):
+        ladder["id"] = f"C{index}"
+    high_entries.sort(key=lambda item: (-item["attempts"], item["pair"][1], item["partition"]))
+    return counts, found, {
+        "method": "partitioned-adjacent-absolute-residual",
+        "absolute_caps": dict(config.absolute_caps),
+        "min_cluster_attempts": config.min_cluster_attempts,
+        "partition_counts": partition_counts,
+        "partitions": partition_metadata,
+        "high_entries": high_entries,
+    }
+
+
+def sensitivity_analysis(
+    counts: Mapping[Pair, int],
+    universe_count: int,
+    config: LadderConfig,
+    currency: str,
+    caps: Sequence[Decimal],
+) -> list[dict[str, object]]:
+    """Run one-currency cap sensitivity while holding all other settings fixed."""
+    output: list[dict[str, object]] = []
+    currency = currency.upper()
+    for cap in caps:
+        varied_caps = dict(config.absolute_caps)
+        varied_caps[currency] = cap
+        ladders, _ = detect_ladders(
+            counts,
+            universe_count,
+            LadderConfig(
+                varied_caps,
+                min_levels=config.min_levels,
+                min_cluster_attempts=config.min_cluster_attempts,
+                multi_anchor_min_attempts=config.multi_anchor_min_attempts,
+            ),
+        )
+        output.append(
+            {
+                "currency": currency,
+                "cap": cap,
+                "ladder_count": len(ladders),
+                "covered_attempts": sum(sum(counts[key] for key in ladder["pairs"]) for ladder in ladders),
+                "ladders": ladders,
+            }
+        )
+    return output
+
+
+def partitioned_sensitivity_analysis(
+    entries: Iterable[tuple[Partition, Pair]],
+    config: LadderConfig,
+    currency: str,
+    caps: Sequence[Decimal],
+) -> list[dict[str, object]]:
+    """Run cap sensitivity over frozen partitions."""
+    entries = tuple(entries)
+    output: list[dict[str, object]] = []
+    currency = currency.upper()
+    for cap in caps:
+        varied_caps = dict(config.absolute_caps)
+        varied_caps[currency] = cap
+        counts, ladders, _ = detect_partitioned_ladders(
+            entries,
+            LadderConfig(
+                varied_caps,
+                min_levels=config.min_levels,
+                min_cluster_attempts=config.min_cluster_attempts,
+                multi_anchor_min_attempts=config.multi_anchor_min_attempts,
+            ),
+        )
+        output.append(
+            {
+                "currency": currency,
+                "cap": cap,
+                "ladder_count": len(ladders),
+                "covered_attempts": sum(sum(counts[(ladder["partition"], key)] for key in ladder["pairs"]) for ladder in ladders),
+                "ladders": ladders,
+            }
+        )
+    return output
+
+
+def normalize_descriptor(value: str) -> str:
+    return re.sub(r"\s+", " ", value.strip()).casefold() or "UNKNOWN_DESCRIPTOR"
+
+
+def normalize_bin_country(value: str) -> str:
+    normalized = re.sub(r"\s+", " ", value.strip()).upper()
+    aliases = {
+        "UNITED STATES": "US",
+        "UNITED STATES OF AMERICA": "US",
+        "USA": "US",
+        "UNITED KINGDOM": "GB",
+        "GREAT BRITAIN": "GB",
+    }
+    return aliases.get(normalized, normalized or "UNKNOWN_BIN_COUNTRY")
+
+
+def _parse_cap(value: str) -> tuple[str, Decimal]:
+    try:
+        currency, amount = value.split("=", 1)
+        cap = Decimal(amount)
+    except Exception as exc:
+        raise argparse.ArgumentTypeError("cap must be CURRENCY=AMOUNT") from exc
+    if not currency.strip() or cap < 0:
+        raise argparse.ArgumentTypeError("cap must use a currency and a non-negative amount")
+    return currency.strip().upper(), cap
+
+
+def _json_value(value: object) -> object:
+    if isinstance(value, Decimal):
+        return format(value, "f")
+    if isinstance(value, tuple) and len(value) == 2:
+        return {"currency": value[0], "amount": _json_value(value[1])}
+    if isinstance(value, set):
+        return [_json_value(item) for item in sorted(value)]
+    if isinstance(value, dict):
+        return {str(key): _json_value(item) for key, item in value.items()}
+    if isinstance(value, list):
+        return [_json_value(item) for item in value]
+    return value
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("csv_path", type=Path)
+    parser.add_argument("--currency-column", required=True)
+    parser.add_argument("--amount-column", required=True)
+    parser.add_argument("--descriptor-column", required=True)
+    parser.add_argument("--bin-country-column")
+    parser.add_argument("--cap", action="append", default=[], type=_parse_cap, metavar="CCY=AMOUNT")
+    parser.add_argument("--sensitivity-cap", action="append", default=[], type=_parse_cap, metavar="CCY=AMOUNT")
+    parser.add_argument("--multi-anchor-min-attempts", type=int, default=24)
+    parser.add_argument("--output", type=Path)
+    args = parser.parse_args()
+
+    entries: list[tuple[Partition, Pair]] = []
+    country_counts: Counter[tuple[Partition, Pair, str]] = Counter()
+    with args.csv_path.open(encoding="utf-8-sig", newline="") as handle:
+        for row in csv.DictReader(handle):
+            partition = normalize_descriptor(row[args.descriptor_column])
+            country = normalize_bin_country(row[args.bin_country_column]) if args.bin_country_column else "UNKNOWN_BIN_COUNTRY"
+            entries.append((partition, (row[args.currency_column].strip().upper(), Decimal(row[args.amount_column].strip()))))
+            country_counts[(partition, entries[-1][1], country)] += 1
+    config = LadderConfig(
+        dict(args.cap),
+        multi_anchor_min_attempts=args.multi_anchor_min_attempts,
+    )
+    _, ladders, metadata = detect_partitioned_ladders(entries, config)
+    for ladder in ladders:
+        components: Counter[str] = Counter()
+        for pair in ladder["pairs"]:
+            for (descriptor, candidate, country), count in country_counts.items():
+                if descriptor == ladder["partition"] and candidate == pair:
+                    components[country] += count
+        ladder["bin_country_components"] = dict(components.most_common())
+    sensitivity: dict[str, list[dict[str, object]]] = {}
+    sensitivity_args: dict[str, list[Decimal]] = defaultdict(list)
+    for currency, cap in args.sensitivity_cap:
+        sensitivity_args[currency].append(cap)
+    for currency, caps in sensitivity_args.items():
+        sensitivity[currency] = partitioned_sensitivity_analysis(entries, config, currency, caps)
+    payload = json.dumps(
+        _json_value({"metadata": metadata, "ladders": ladders, "sensitivity": sensitivity}),
+        ensure_ascii=False,
+        indent=2,
+    )
+    if args.output:
+        args.output.write_text(payload + "\n", encoding="utf-8")
+    else:
+        print(payload)
+
+
+if __name__ == "__main__":
+    main()

package/skills/payment/tld-detection/tests/test_detect_ladders.py

@@ -0,0 +1,132 @@
+from collections import Counter
+import csv
+from decimal import Decimal
+import importlib.util
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+
+sys.dont_write_bytecode = True
+SCRIPT = Path(__file__).parents[1] / "scripts" / "detect_ladders.py"
+SPEC = importlib.util.spec_from_file_location("detect_ladders", SCRIPT)
+MODULE = importlib.util.module_from_spec(SPEC)
+assert SPEC.loader is not None
+sys.modules[SPEC.name] = MODULE
+SPEC.loader.exec_module(MODULE)
+
+
+def pair(amount: str) -> tuple[str, Decimal]:
+    return "USD", Decimal(amount)
+
+
+class DetectLaddersTest(unittest.TestCase):
+    def detect(self, values: dict[str, int], cap: str = "0.15"):
+        counts = Counter({pair(amount): count for amount, count in values.items()})
+        return MODULE.detect_ladders(
+            counts,
+            sum(counts.values()),
+            MODULE.LadderConfig({"USD": Decimal(cap)}),
+        )[0]
+
+    def test_detects_tight_exact_ladder(self):
+        ladders = self.detect({"28.03": 131, "56.04": 117, "112.09": 65, "224.19": 27, "70.00": 100})
+        amounts = {amount for _, amount in ladders[0]["pairs"]}
+        self.assertEqual(amounts, {Decimal("28.03"), Decimal("56.04"), Decimal("112.09"), Decimal("224.19")})
+
+    def test_keeps_multiple_exact_anchors_at_one_level(self):
+        ladders = self.detect({"14.41": 34, "14.52": 25, "28.94": 43, "57.96": 29, "80.00": 100})
+        levels = next(ladder["levels"] for ladder in ladders if pair("28.94") in ladder["pairs"])
+        self.assertEqual(levels[-1], {pair("14.41"), pair("14.52")})
+
+    def test_rejects_upper_amount_outside_absolute_cap(self):
+        ladders = self.detect({"14.41": 34, "28.94": 43, "57.96": 29, "116.85": 29, "80.00": 100})
+        ladder = next(ladder for ladder in ladders if pair("14.41") in ladder["pairs"])
+        self.assertNotIn(pair("116.85"), ladder["pairs"])
+
+    def test_requires_explicit_currency_cap(self):
+        with self.assertRaisesRegex(ValueError, "missing absolute residual cap"):
+            MODULE.detect_ladders(Counter({pair("10"): 10}), 10, MODULE.LadderConfig({}))
+
+    def test_ignores_currency_below_rung_pool_threshold(self):
+        counts = Counter({pair("10"): 1000, ("EUR", Decimal("9.99")): 1})
+        ladders, _ = MODULE.detect_ladders(counts, 1001, MODULE.LadderConfig({"USD": Decimal("0.15")}))
+        self.assertEqual(ladders, [])
+
+    def test_sensitivity_reports_coverage_by_cap(self):
+        counts = Counter({pair("14.41"): 34, pair("28.94"): 43, pair("57.96"): 29})
+        rows = MODULE.sensitivity_analysis(
+            counts,
+            sum(counts.values()),
+            MODULE.LadderConfig({"USD": Decimal("0.15")}),
+            "USD",
+            [Decimal("0.10"), Decimal("0.15")],
+        )
+        self.assertEqual([row["ladder_count"] for row in rows], [0, 1])
+
+    def test_keeps_below_threshold_family_out_of_clusters(self):
+        counts = Counter({pair("10"): 32, pair("20"): 32, pair("40"): 32})
+        ladders, metadata = MODULE.detect_ladders(
+            counts,
+            96,
+            MODULE.LadderConfig({"USD": Decimal("0.15")}),
+        )
+        self.assertEqual(ladders, [])
+        self.assertEqual(metadata["below_threshold"][0]["attempts"], 96)
+
+    def test_same_pair_can_belong_to_different_partitions(self):
+        entries = []
+        amounts = (("10", 40), ("20", 40), ("40", 40))
+        for partition in ("alpha", "beta"):
+            for amount, count in amounts:
+                entries.extend([(partition, pair(amount))] * count)
+        _, ladders, _ = MODULE.detect_partitioned_ladders(
+            entries,
+            MODULE.LadderConfig({"USD": Decimal("0.15")}),
+        )
+        self.assertEqual(len(ladders), 2)
+        self.assertEqual({ladder["partition"] for ladder in ladders}, {"alpha", "beta"})
+
+    def test_requires_at_least_three_levels(self):
+        self.assertEqual(self.detect({"10": 60, "20": 60, "70": 100}), [])
+
+    def test_rejects_non_two_x_relationships(self):
+        self.assertEqual(self.detect({"10": 40, "30": 40, "90": 40}), [])
+
+    def test_cli_attributes_bin_country_after_descriptor_ladder(self):
+        with tempfile.TemporaryDirectory() as directory:
+            csv_path = Path(directory) / "clean.csv"
+            with csv_path.open("w", encoding="utf-8", newline="") as handle:
+                writer = csv.DictWriter(handle, fieldnames=["descriptor", "country", "currency", "amount"])
+                writer.writeheader()
+                for country in ("US", "GB"):
+                    for amount in ("10", "20", "40"):
+                        writer.writerows(
+                            {"descriptor": "ACME", "country": country, "currency": "USD", "amount": amount}
+                            for _ in range(20)
+                        )
+            result = subprocess.run(
+                [
+                    sys.executable,
+                    str(SCRIPT),
+                    str(csv_path),
+                    "--descriptor-column", "descriptor",
+                    "--bin-country-column", "country",
+                    "--currency-column", "currency",
+                    "--amount-column", "amount",
+                    "--cap", "USD=0.15",
+                ],
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+        payload = json.loads(result.stdout)
+        self.assertEqual(len(payload["ladders"]), 1)
+        self.assertEqual(payload["ladders"][0]["bin_country_components"], {"US": 60, "GB": 60})
+
+
+if __name__ == "__main__":
+    unittest.main()