feat(predict): EWMA gas-price trade penalty for mint/redeem

[tonylee08]

Summary

• Port DeepBook core's gas-price EWMA penalty into Predict's mint and live redeem flows.
• Each ExpiryMarket now keeps a smoothed (mean, variance) of ctx.gas_price() (sources/ewma.move), seeded at create_and_share. On every mint/live-redeem it folds in the current gas price.
• When the penalty is enabled and gas sits above the mean by more than z_score_threshold standard deviations, a flat additional_fee × quantity surcharge is added on top of the (stake-discounted) trading fee.
• Admin-tunable knobs live in a new EwmaConfig (sources/config/ewma_config.move) inside ProtocolConfig: alpha, z_score_threshold, additional_fee, enabled. New admin entrypoints protocol_config::set_ewma_params and set_ewma_enabled (AdminCap-gated, bounds-checked). Disabled by default.
• OrderMinted / LiveOrderRedeemed events gain a penalty_fee field; new EwmaConfigUpdated event on admin changes.

Key decisions

• Faithful gas-price port: tracks ctx.gas_price() exactly like DeepBook core (not oracle price), with the same mean/variance/z-score math.
• Per-ExpiryMarket state, not global: the market is already &mut in mint/redeem, so this adds zero new shared-object contention — the analog of DeepBook's per-pool EWMA. Tradeoff: each market cold-starts (variance = 0), so the penalty can't fire until a couple of differently-priced trades accumulate variance.
• Config/state split per Predict conventions: tunable params in EwmaConfig (read immutably in the flow), evolving estimate in ExpiryMarket (mutated in place).
• Penalty is flat and not discounted: additional_fee × quantity, independent of the fee, applied after the stake discount — stakers pay the full surcharge, mirroring DeepBook.
• Penalty is pure pool surplus: joined to cash_balance, excluded from the builder cut, the rebate fee basis, and gross P&L. On redeem it is capped at redeem_amount − fee − builder_fee so it can never over-withhold the payout.
• Applied to mint + live redeem only (settled/liquidated redeem have no live fee).

Test plan

• sui move test --path packages/predict --gas-limit 100000000000 — 483 tests pass (21 new EWMA tests).
• Unit (ewma_tests): hand-derived mean/variance, z-score crossing (fires >1σ, not at default 3σ), disabled / zero-variance / below-mean → 0, same-ms no-op.
• Config/admin (ewma_config_tests, admin_setters_tests): defaults, every bound, all three new abort codes, setter forwarding, enable toggle.
• Integration (expiry_market_tests): a real 1000→2000→3000 gas spike through mint (extra cost equals the surcharge; penalty is not recorded as a trading fee) and through redeem (two identical positions; the penalized one pays exactly the surcharge less).
• Follow-up: add a redeem test that exercises the penalty .min() cap (deep-OTM low-value redeem where penalty ≥ remaining payout).
• Follow-up: admin TS script for the new setters (no first-party predict admin-config-setter pattern exists in scripts/ to mirror).

🤖 Generated with Claude Code