From 2c8384e44a4cfe1fa4907f821bcd36c4a698b94f Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Sun, 11 Oct 2026 09:46:45 +0200
Subject: [PATCH] Pin that a signed-in retract spends the account budget

Hand mutant retract-key-ignores-signed-in-voter survived the first table.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../ConceptVoteRateLimitTests.cs                | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/tests/Bifrost.Web.Tests/ConceptVoteRateLimitTests.cs b/tests/Bifrost.Web.Tests/ConceptVoteRateLimitTests.cs
index 5049071..b2beb0b 100644
--- a/tests/Bifrost.Web.Tests/ConceptVoteRateLimitTests.cs
+++ b/tests/Bifrost.Web.Tests/ConceptVoteRateLimitTests.cs
@@ -152,6 +152,23 @@ public sealed class ConceptVoteRateLimitTests : IClassFixture<ConceptVoteRateLim
         Assert.Equal(HttpStatusCode.Redirect, visitorOk.StatusCode);
     }
 
+    [Fact]
+    public async Task Retract_by_a_signed_in_account_spends_the_account_budget_from_any_prefix()
+    {
+        var collection = await NewSubject();
+        var home = new Client(_factory, "203.0.113.60") { Account = ("7003", "carol-limits") };
+        var away = new Client(_factory, "203.0.113.61") { Account = ("7003", "carol-limits") };
+        var elsewhere = new Client(_factory, "203.0.113.62") { Account = ("7003", "carol-limits") };
+        await home.Post(collection, "Up");
+        await home.Post(collection, "Down");
+        using var third = await away.Post(collection, "Retract");
+        Assert.Equal(HttpStatusCode.Redirect, third.StatusCode);
+
+        using var denied = await elsewhere.Post(collection, "Retract");
+
+        Assert.Equal(HttpStatusCode.TooManyRequests, denied.StatusCode);
+    }
+
     [Fact]
     public async Task Mint_budget_is_spent_only_by_minting_casts()
     {