diff --git a/client/src/adapter/__tests__/server-draft-adapter.test.ts b/client/src/adapter/__tests__/server-draft-adapter.test.ts
index ccad40aa25..e0a867ccce 100644
--- a/client/src/adapter/__tests__/server-draft-adapter.test.ts
+++ b/client/src/adapter/__tests__/server-draft-adapter.test.ts
@@ -115,6 +115,7 @@ const viewerInteraction = {
   autoPassRecommended: false,
   opportunities: [],
   attachmentFans: {},
+  attachmentViews: {},
   availability: { type: "inputRequired" },
 } as LegalActionsResult["viewerInteraction"];
 
diff --git a/client/src/adapter/generated/interaction/index.ts b/client/src/adapter/generated/interaction/index.ts
index 9a2a393660..63464cbb66 100644
--- a/client/src/adapter/generated/interaction/index.ts
+++ b/client/src/adapter/generated/interaction/index.ts
@@ -111,9 +111,18 @@ export type InteractionAttachmentFanChild = { objectId: number, submission: Inte
 
 export type InteractionAttachmentFan = { hostId: number, children: Array<InteractionAttachmentFanChild>, };
 
+export type InteractionAttachmentViewCard = { objectId: number, submission: InteractionSubmission | null, };
+
+export type InteractionAttachmentView = { hostId: number, cards: Array<InteractionAttachmentViewCard>, };
+
 export type InteractionAvailability = { "type": "progressAvailable", "data": { witness: InteractionSubmission, } } | { "type": "inputRequired" } | { "type": "escapeOnly", "data": { reason: InteractionReasonCode, } } | { "type": "waiting" } | { "type": "terminal", "data": { outcome: InteractionOutcomeCode, } } | { "type": "unsupported", "data": { reason: InteractionReasonCode, } } | { "type": "stuck", "data": { reason: InteractionReasonCode, } };
 
-export type ViewerInteraction = { waitingForKind: InteractionWaitingForKind, authorizedSubmitters: Array<number>, canSubmit: boolean, autoPassRecommended: boolean, opportunities: Array<InteractionOpportunity>, attachmentFans: Record<number, InteractionAttachmentFan>, availability: InteractionAvailability, };
+export type ViewerInteraction = { waitingForKind: InteractionWaitingForKind, authorizedSubmitters: Array<number>, canSubmit: boolean, autoPassRecommended: boolean, opportunities: Array<InteractionOpportunity>, attachmentFans: Record<number, InteractionAttachmentFan>, 
+/**
+ * What is attached to each visible object, keyed by that object. Published
+ * on every projection, including the ones that carry no opportunity at all.
+ */
+attachmentViews: Record<number, InteractionAttachmentView>, availability: InteractionAvailability, };
 
 export type AmountAssignment = { choiceId: InteractionChoiceId, amount: number, };
 
diff --git a/client/src/components/board/AttachmentFan.tsx b/client/src/components/board/AttachmentFan.tsx
index 12829ed0b0..53459f2dd1 100644
--- a/client/src/components/board/AttachmentFan.tsx
+++ b/client/src/components/board/AttachmentFan.tsx
@@ -3,6 +3,7 @@ import { createPortal } from "react-dom";
 import { motion } from "framer-motion";
 import { useTranslation } from "react-i18next";
 
+import type { InteractionSubmission } from "../../adapter/generated/interaction/index.ts";
 import type { ObjectId } from "../../adapter/types.ts";
 import { dispatchAction, dispatchInteraction } from "../../game/dispatch.ts";
 import { useCanActForWaitingState } from "../../hooks/usePlayerId.ts";
@@ -59,11 +60,17 @@ function fanCardSizingStyle(cardCount: number): CSSProperties {
  * independent object), and the fan lets the player choose which one without
  * hunting the peek.
  *
- * The fan NEVER invents a choice. It has exactly two engine-owned sources: an
- * open interaction's projection (mode 1), and — when no prompt is open — the
- * permanent's own legal-action bucket read through `deriveActivationAffordances`
- * (mode 2, the same authority the battlefield ring uses). Each card lights up
- * (cyan) and dispatches only what one of those two offers for that object. Terminal
+ * Membership is not this component's decision. `viewerInteraction.attachmentViews`
+ * publishes what is attached to the host, ordered and both-direction validated by
+ * the engine; the fan renders that list and never scans `attachments` itself.
+ *
+ * The fan NEVER invents a choice either. It has exactly two engine-owned sources
+ * per card: the submission the projection published for that card (mode 1), and
+ * — for a card it published none for — the permanent's own legal-action bucket
+ * read through `deriveActivationAffordances` (mode 2, the same authority the
+ * battlefield ring uses). Both live side by side in one fan, because a published
+ * pick for one attachment says nothing about its neighbours. Each card lights up
+ * (cyan) and dispatches only what one of those two offers for that object.
  * One-step picks close the fan. Multi-step decisions stay in their dedicated
  * engine-authored interaction surfaces instead of asking this display to build
  * a response payload.
@@ -98,25 +105,24 @@ export function AttachmentFan() {
     [affordances],
   );
   const host = hostId != null ? objects?.[hostId] : undefined;
-  const interactionFan = useMemo(
-    () =>
-      hostId == null
-        ? null
-        : (viewerInteraction?.attachmentFans[hostId] ?? null),
+  // THE membership authority: the engine publishes what is attached to this
+  // host, in its own order, with a submission on any card it published a
+  // one-step pick for. This display neither walks `attachments` nor decides who
+  // belongs in the fan — it renders the projection and counts it.
+  const attachmentView = useMemo(
+    () => (hostId == null ? null : (viewerInteraction?.attachmentViews[hostId] ?? null)),
     [hostId, viewerInteraction],
   );
+  const submissionById = useMemo(() => {
+    const table = new Map<ObjectId, InteractionSubmission>();
+    for (const card of attachmentView?.cards ?? []) {
+      if (card.submission !== null) table.set(card.objectId, card.submission);
+    }
+    return table;
+  }, [attachmentView]);
 
-  // During an interaction, the engine projection is the sole authority for
-  // which direct attachments belong in the fan. The fallback preserves the
-  // existing read-only badge outside an interaction, where no choice is being
-  // exposed and therefore no interaction capability exists to consume.
   const cardIds = host
-    ? [
-        host.id,
-        ...(interactionFan
-          ? interactionFan.children.map((child) => child.objectId)
-          : host.attachments),
-      ]
+    ? [host.id, ...(attachmentView?.cards ?? []).map((card) => card.objectId)]
     : [];
 
   const close = useCallback(() => {
@@ -148,12 +154,13 @@ export function AttachmentFan() {
 
   const handlePick = useCallback(
     (id: ObjectId) => {
-      // Mode 1 — an engine interaction owns the prompt: the projection is the sole
-      // authority and the fan only forwards its opaque submission. UNCHANGED.
-      if (interactionFan !== null) {
-        const child = interactionFan.children.find((candidate) => candidate.objectId === id);
-        if (!child || !viewerInteraction?.canSubmit) return;
-        void dispatchInteraction(child.submission).then(close).catch(notifyFailure);
+      // Mode 1 — the engine published a pick for THIS card: forward its opaque
+      // submission, nothing else. Decided per card, because the projection
+      // carries a pick for some members and none for others.
+      const submission = submissionById.get(id);
+      if (submission) {
+        if (!viewerInteraction?.canSubmit) return;
+        void dispatchInteraction(submission).then(close).catch(notifyFailure);
         return;
       }
       // Mode 2 — no prompt is open, so the fan is a reachability surface for the
@@ -199,14 +206,16 @@ export function AttachmentFan() {
       affordances,
       canActivate,
       close,
-      interactionFan,
+      submissionById,
       notifyFailure,
       setPendingAbilityChoice,
       viewerInteraction?.canSubmit,
     ],
   );
 
-  if (hostId == null || !host || cardIds.length === 0) return null;
+  // A fan of just the host is not a fan. With no published membership there is
+  // nothing to spread, and this display does not go looking for members itself.
+  if (hostId == null || !host || (attachmentView?.cards.length ?? 0) === 0) return null;
 
   // Shared compact whole-row fan — sized by the total card count so the host +
   // its attachments stay within the overlay's viewport budget.
@@ -239,7 +248,11 @@ export function AttachmentFan() {
             rotation={fan.rotation(i)}
             arcOffset={fan.arc(i)}
             zIndex={i}
-            selectable={id !== host.id && (interactionFan !== null || canActivate(id))}
+            selectable={
+              id !== host.id &&
+              ((submissionById.has(id) && viewerInteraction?.canSubmit === true) ||
+                canActivate(id))
+            }
             onPick={handlePick}
           />
         ))}
diff --git a/client/src/components/board/PermanentCard.tsx b/client/src/components/board/PermanentCard.tsx
index 44930fbe14..764011ad1c 100644
--- a/client/src/components/board/PermanentCard.tsx
+++ b/client/src/components/board/PermanentCard.tsx
@@ -473,9 +473,11 @@ export const PermanentCard = memo(function PermanentCard({
     (s) => obj && s.gameState?.players?.find((p) => p.id === obj.controller)?.commander_color_identity,
   );
   const viewerInteraction = useGameStore((s) => s.viewerInteraction);
-  const interactionAttachmentFan = useMemo(
-    () =>
-      viewerInteraction?.attachmentFans[objectId] ?? null,
+  // The engine's own list of what is attached to this permanent, with a
+  // submission on each card it published a pick for. Same field `AttachmentFan`
+  // renders, so the badge's label can never promise a card the fan won't show.
+  const attachmentView = useMemo(
+    () => viewerInteraction?.attachmentViews[objectId] ?? null,
     [objectId, viewerInteraction],
   );
 
@@ -505,10 +507,13 @@ export const PermanentCard = memo(function PermanentCard({
 
   const ptDisplay = computePTDisplay(obj);
   const isSelected = selectedObjectId === objectId;
-  // The viewer-scoped engine projection owns both the direct-attachment
-  // relationship and whether one is actionable for this interaction. The
-  // board must not rediscover either fact from the raw snapshot.
-  const attachmentsActionable = interactionAttachmentFan !== null;
+  // The viewer-scoped engine projection owns both the attachment relationship
+  // and whether one is actionable for this interaction. The board must not
+  // rediscover either fact from the raw snapshot. "Actionable" is per card:
+  // the projection lists every attachment and marks the ones it published a
+  // pick for, so this asks whether ANY of them carries one.
+  const attachmentsActionable =
+    attachmentView?.cards.some((card) => card.submission !== null) ?? false;
   const attachmentsLifted =
     obj.attachments.length > 0
     && (attachmentsLiftedByAncestor || isInHoveredAttachmentTree);
@@ -517,6 +522,12 @@ export const PermanentCard = memo(function PermanentCard({
   const attachmentPathIds = new Set([...attachmentRenderPath, objectId]);
   const renderableAttachmentIds = visibleAttachmentIds.filter((id) => !attachmentPathIds.has(id));
   const hiddenAttachmentCount = obj.attachments.length - visibleAttachmentIds.length;
+  // What the fan will actually put on screen, for the `⧉` control's label: the
+  // very list the fan renders. Counting `obj.attachments` here would be both a
+  // second derivation and a wrong number — the projection also carries the
+  // attachments OF the attachments, which the fan shows and the peek stack
+  // cannot.
+  const attachmentFanCardCount = attachmentView?.cards.length ?? 0;
   const exileLinksExpanded = exileLinks.length <= 1 || isHovered || isSelected || isInspected;
   const visibleExileLinks = exileLinksExpanded ? exileLinks : exileLinks.slice(0, 1);
   const hiddenExileCount = exileLinks.length - visibleExileLinks.length;
@@ -684,12 +695,6 @@ export const PermanentCard = memo(function PermanentCard({
       });
     } else if (isValidTarget) {
       dispatchAction({ type: "ChooseTarget", data: { target: { Object: objectId } } });
-    } else if (attachmentsActionable) {
-      // The host is not a legal choice, but one of its attachments is. Open
-      // the full-card chooser rather than requiring a precise click on an
-      // overlapping attachment peek. The fan derives every selectable card
-      // from the engine's current legal-target set.
-      showAttachmentFan();
     } else if (isActivatable) {
       // THE single authority for "what does a click on this bucket do"
       // (viewmodel/cardActionChoice.ts). Owns the CR 605.1a mana/non-mana
@@ -723,6 +728,25 @@ export const PermanentCard = memo(function PermanentCard({
       }
     } else if (isUndoableTap) {
       dispatchAction({ type: "UntapLandForMana", data: { object_id: objectId } });
+    } else if (attachmentsActionable) {
+      // The host is not a legal choice, but one of its attachments is. Open
+      // the full-card chooser rather than requiring a precise click on an
+      // overlapping attachment peek. The fan derives every selectable card
+      // from the engine's current legal-target set.
+      //
+      // Placed after the host's own target / activation / undo intent for the
+      // same reason the affordance-set branch below is placed last: the premise
+      // "the host is not a legal choice" is not something this branch can see.
+      // During Priority `HumanResponseModel::ExactCandidates` publishes a fan for
+      // EVERY activatable attachment, so the fan's existence says nothing about
+      // the host — and while this sat above `isActivatable`, a creature with its
+      // own ability was unreachable whenever an Aura or Equipment on it was also
+      // activatable. The fan cannot stand in for the host either: it excludes the
+      // host by design (`AttachmentFan.tsx`, `id !== host.id`), so the host's
+      // ability had no path at all. Reported for Slumbering Keepguard under
+      // Cooped Up, whose `{2}{W}` is legitimately activatable from the
+      // battlefield — no engine defect required.
+      showAttachmentFan();
     } else if (
       obj.attachments.some(
         (attachId) => activatableObjectIds.has(attachId) || manaTappableObjectIds.has(attachId),
@@ -1106,7 +1130,42 @@ export const PermanentCard = memo(function PermanentCard({
         />
       )}
 
-      {obj.attachments.length === 1 && (
+      {/* The explicit route into the fan, and the ONLY one once the host's own
+          click belongs to the host (see the `attachmentsActionable` branch). The
+          `+N` control above covers the collapsed case and this covers the
+          expanded one — `attachmentsExpanded` is the same predicate `+N` is
+          derived from, so the two are complementary by construction and exactly
+          one entry point renders in every state.
+          Was `length === 1`, which left a host with SEVERAL expanded attachments
+          with no entry point at all — the state Priority produces, because
+          `attachmentsActionable` is itself one of the disjuncts that expands the
+          stack, and each attachment is then reachable only through a ~22px peek
+          rendered behind the host face.
+          Two states the gate deliberately leaves without a control, so the
+          "complementary" claim above is not unconditional: with no attachments
+          neither renders and none is needed, and on a NESTED host the button is
+          painted inside the peek wrapper's `zIndex: 5 - i` and so sits under the
+          parent's card face, focus ring included — the working fallback there is
+          that host's OWN peek, which opens a fan keyed to it, and since a fan
+          lists a host plus its direct children that is one hop per level and
+          therefore enough.
+          The size is left exactly as it was, deliberately. This control is now
+          the pointer route where the host's own click used to open the fan, and
+          at `clamp(20px, …, 28px)` it is under the 44px floor the branch above
+          cites — but 44px is not reachable here. Battlefield cards sit in an
+          8px gap (`BattlefieldRow.tsx:176`, `const gap = 8`) and `--card-base`
+          floors at 3.5rem, so at `-left-2.5` the badge already overhangs the
+          gap; growing outward to 44px would put ~26px over the NEIGHBOUR's face
+          at `z-40` and steal its clicks, and growing inward would swallow most
+          of a 56px card — either way re-creating, in miniature, the click theft
+          this branch exists to undo. A sub-44px target that takes only its own
+          corner is the better trade; the floor needs a layout-level answer
+          (badge sizes are shared with `+N` and the group-expand control at
+          `GroupedPermanent.tsx:279`, which caps its own overhang at 12px). */}
+      {/* Gated on the projected count, not on `obj.attachments`: the control
+          opens a fan built from the projection, so if the engine published no
+          membership there is nothing behind the badge to show. */}
+      {attachmentFanCardCount > 0 && attachmentsExpanded && (
         <button
           type="button"
           className="absolute -left-2.5 -top-2.5 z-40 flex items-center justify-center rounded-full bg-black/90 leading-none text-amber-200 ring-2 ring-amber-200/80 shadow-[0_2px_8px_rgba(0,0,0,0.65)] transition-transform hover:scale-105 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-white"
@@ -1115,8 +1174,8 @@ export const PermanentCard = memo(function PermanentCard({
             height: attachmentBadgeSize,
             fontSize: attachmentBadgeFontSize,
           }}
-          title={t("permanent.viewAttachmentsFor", { count: 1, name: obj.name })}
-          aria-label={t("permanent.viewAttachmentsFor", { count: 1, name: obj.name })}
+          title={t("permanent.viewAttachmentsFor", { count: attachmentFanCardCount, name: obj.name })}
+          aria-label={t("permanent.viewAttachmentsFor", { count: attachmentFanCardCount, name: obj.name })}
           onPointerDown={(event) => event.stopPropagation()}
           onClick={openAttachmentFan}
         >
diff --git a/client/src/components/board/__tests__/AttachmentFan.test.tsx b/client/src/components/board/__tests__/AttachmentFan.test.tsx
index dd217bb919..16620010b6 100644
--- a/client/src/components/board/__tests__/AttachmentFan.test.tsx
+++ b/client/src/components/board/__tests__/AttachmentFan.test.tsx
@@ -20,7 +20,12 @@ import { AttachmentFan } from "../AttachmentFan.tsx";
 
 /**
  * `AttachmentFan` mode 2 — the fan as a reachability surface for an attached
- * permanent's OWN legal actions (plan §6.9). Rows V1–V9.
+ * permanent's OWN legal actions (plan §6.9). Rows V1–V12.
+ *
+ * Membership is NOT tested here beyond "the fan renders exactly what the engine
+ * published", because it is no longer this component's decision:
+ * `crates/engine/tests/integration/interaction_contract.rs` owns the subtree
+ * walk, its order and its both-direction validation.
  *
  * THE BUG THIS MODULE COVERS: with Kilo (401) enchanted by Freed from the Real
  * (408), the engine published `legalActionsByObject["408"] = [#0, #1]` and the
@@ -130,8 +135,9 @@ function seed(options: {
   freedAbilities?: unknown[];
   viewerInteraction?: ViewerInteraction | null;
 } = {}) {
+  const attachments = options.attachments ?? [FREED_ID];
   const gameState = makeState({
-    attachments: options.attachments,
+    attachments,
     freedAbilities: options.freedAbilities,
   });
   const waitingFor = options.waitingFor ?? gameState.waiting_for;
@@ -142,7 +148,11 @@ function seed(options: {
     waitingFor,
     legalActions: [],
     legalActionsByObject: options.legalActionsByObject ?? {},
-    viewerInteraction: options.viewerInteraction ?? null,
+    // Membership comes from the engine on every projection, prompt or not, so
+    // the default fixture publishes it with no pick attached. Passing `null`
+    // explicitly models a projection that never arrived.
+    viewerInteraction:
+      options.viewerInteraction === undefined ? projection(attachments) : options.viewerInteraction,
   });
   useUiStore.setState({ attachmentFanHostId: HOST_ID, pendingAbilityChoice: null });
   return render(<AttachmentFan />);
@@ -168,22 +178,39 @@ function isSelectable(name: string): boolean {
   return ringed;
 }
 
-function interactionOver(objectIds: number[]): ViewerInteraction {
+/**
+ * An engine-shaped projection for this fixture's host.
+ *
+ * `members` is what the engine publishes as attached — the whole subtree, in
+ * its order — and `published` the subset it ALSO published a one-step pick for.
+ * The two lists differ on purpose: the engine publishes a fan per direct host
+ * and only for a child with exactly one legal choice, so a member without a
+ * pick is the normal case, not an edge case.
+ */
+function projection(
+  members: number[],
+  options: { published?: number[]; canSubmit?: boolean } = {},
+): ViewerInteraction {
+  const published = options.published ?? [];
   const interactionId = "fan-interaction" as InteractionId;
   const choiceId = (objectId: number) => `fan-${objectId}` as InteractionChoiceId;
+  const submission = (objectId: number) => ({
+    interactionId,
+    response: { type: "choose" as const, data: { choiceId: choiceId(objectId) } },
+  });
   return {
     waitingForKind: { simultaneous: null, terminal: false, code: "choose" },
     authorizedSubmitters: [0],
-    canSubmit: true,
+    canSubmit: options.canSubmit ?? true,
     autoPassRecommended: false,
-    opportunities: [{
+    opportunities: published.length === 0 ? [] : [{
       interactionId,
       response: {
         type: "exactChoices",
         data: {
-          choices: objectIds.map((objectId) => ({
+          choices: published.map((objectId) => ({
             id: choiceId(objectId),
-            status: { type: "available" },
+            status: { type: "available" as const },
             surfaces: [],
           })),
         },
@@ -191,20 +218,23 @@ function interactionOver(objectIds: number[]): ViewerInteraction {
       surfaces: [],
       progress: { selected: 0, minimum: 1, maximum: 1, aggregate: null, confirmable: false },
     }],
-    attachmentFans: {
+    attachmentFans: published.length === 0 ? {} : {
       [HOST_ID]: {
         hostId: HOST_ID,
-        children: objectIds.map((objectId) => ({
+        children: published.map((objectId) => ({ objectId, submission: submission(objectId) })),
+      },
+    },
+    attachmentViews: {
+      [HOST_ID]: {
+        hostId: HOST_ID,
+        cards: members.map((objectId) => ({
           objectId,
-          submission: {
-            interactionId,
-            response: { type: "choose", data: { choiceId: choiceId(objectId) } },
-          },
+          submission: published.includes(objectId) ? submission(objectId) : null,
         })),
       },
     },
     availability: { type: "inputRequired" },
-  };
+  } as ViewerInteraction;
 }
 
 describe("AttachmentFan mode 2 — the permanent's own legal actions", () => {
@@ -349,7 +379,7 @@ describe("AttachmentFan mode 2 — the permanent's own legal actions", () => {
   it("still forwards the engine's own submission when an interaction owns the prompt", () => {
     seed({
       legalActionsByObject: {},
-      viewerInteraction: interactionOver([FREED_ID]),
+      viewerInteraction: projection([FREED_ID], { published: [FREED_ID] }),
     });
 
     fireEvent.click(fanCard("Freed from the Real"));
@@ -375,7 +405,7 @@ describe("AttachmentFan mode 2 — the permanent's own legal actions", () => {
   it("lets the engine interaction win when a prompt and a bucket are both live", () => {
     seed({
       legalActionsByObject: { [String(FREED_ID)]: [FREED_TAP, FREED_UNTAP] },
-      viewerInteraction: interactionOver([FREED_ID]),
+      viewerInteraction: projection([FREED_ID], { published: [FREED_ID] }),
     });
 
     fireEvent.click(fanCard("Freed from the Real"));
@@ -384,4 +414,52 @@ describe("AttachmentFan mode 2 — the permanent's own legal actions", () => {
     expect(dispatchAction).not.toHaveBeenCalled();
     expect(useUiStore.getState().pendingAbilityChoice).toBeNull();
   });
+
+  // V10 — THE SECOND USER-VISIBLE BUG. The engine published a pick for the Boots
+  // and none for the Aura; both are still attached, so both are still in the fan.
+  // The old fan read the published list as its membership list and the Aura
+  // vanished from the only surface that shows attached cards.
+  //
+  // MEASURED (drop side): rebuilding `cardIds` from the published picks only
+  //   reports `AssertionError: expected null not to be null` on the Aura's card.
+  it("lists an attachment the engine published no pick for, beside one it did", () => {
+    seed({
+      attachments: [FREED_ID, BOOTS_ID],
+      viewerInteraction: projection([FREED_ID, BOOTS_ID], { published: [BOOTS_ID] }),
+    });
+
+    expect(fanCard("Freed from the Real")).not.toBeNull();
+    expect(isSelectable("Swiftfoot Boots")).toBe(true);
+    expect(isSelectable("Freed from the Real")).toBe(false);
+
+    fireEvent.click(fanCard("Swiftfoot Boots"));
+    expect(dispatchInteraction).toHaveBeenCalledTimes(1);
+  });
+
+  // V11 — a published pick the viewer may not submit is not offered. The click
+  // path already refused it (`canSubmit`), so lighting it up promised an action
+  // that could not happen.
+  //
+  // MEASURED (always side): dropping `canSubmit` from `selectable` flips the
+  //   first assert to `AssertionError: expected true to be false`.
+  it("offers nothing while the viewer may not submit", () => {
+    seed({
+      viewerInteraction: projection([FREED_ID], { published: [FREED_ID], canSubmit: false }),
+    });
+
+    expect(isSelectable("Freed from the Real")).toBe(false);
+    fireEvent.click(fanCard("Freed from the Real"));
+    expect(dispatchInteraction).not.toHaveBeenCalled();
+  });
+
+  // V12 — no projection, no fan. The membership authority is the engine's alone:
+  // with nothing published there is nothing to show, and the display must NOT
+  // fall back to walking `attachments` itself (CLAUDE.md: the frontend is a
+  // display layer). The host is attached-to in the fixture, so a fallback would
+  // be plainly visible here.
+  it("shows no fan at all when the engine published no membership", () => {
+    seed({ attachments: [FREED_ID, BOOTS_ID], viewerInteraction: null });
+
+    expect(document.querySelector("[data-attachment-fan]")).toBeNull();
+  });
 });
diff --git a/client/src/components/board/__tests__/PermanentCard.test.tsx b/client/src/components/board/__tests__/PermanentCard.test.tsx
index 036c82167e..ef0eeae578 100644
--- a/client/src/components/board/__tests__/PermanentCard.test.tsx
+++ b/client/src/components/board/__tests__/PermanentCard.test.tsx
@@ -146,9 +146,23 @@ function renderPermanent(
   );
 }
 
-function interactionForAttachedObjects(objectIds: number[]): ViewerInteraction {
+/**
+ * The engine's projection for host 1: `members` is everything it publishes as
+ * attached to that host — its whole subtree — and `objectIds` the subset it also
+ * published a one-step pick for. A member without a pick is the ordinary case:
+ * the engine publishes picks per direct host and only for a child with exactly
+ * one legal choice.
+ */
+function interactionForAttachedObjects(
+  objectIds: number[],
+  members: number[] = objectIds,
+): ViewerInteraction {
   const interactionId = "attachment-interaction" as InteractionId;
   const choiceId = (objectId: number) => `attachment-${objectId}` as InteractionChoiceId;
+  const submission = (objectId: number) => ({
+    interactionId,
+    response: { type: "choose" as const, data: { choiceId: choiceId(objectId) } },
+  });
   return {
     waitingForKind: { simultaneous: null, terminal: false, code: "choose" },
     authorizedSubmitters: [0],
@@ -171,24 +185,78 @@ function interactionForAttachedObjects(objectIds: number[]): ViewerInteraction {
     }],
     attachmentFans: {
       1: {
-      hostId: 1,
-      children: objectIds.map((objectId) => ({
-        objectId,
-        submission: {
-          interactionId,
-          response: { type: "choose", data: { choiceId: choiceId(objectId) } },
-        },
-      })),
+        hostId: 1,
+        children: objectIds.map((objectId) => ({ objectId, submission: submission(objectId) })),
+      },
+    },
+    attachmentViews: members.length === 0 ? {} : {
+      1: {
+        hostId: 1,
+        cards: members.map((objectId) => ({
+          objectId,
+          submission: objectIds.includes(objectId) ? submission(objectId) : null,
+        })),
       },
     },
     availability: { type: "inputRequired" },
-  };
+  } as ViewerInteraction;
 }
 
 function interactionForAttachedObject(objectId: number): ViewerInteraction {
   return interactionForAttachedObjects([objectId]);
 }
 
+/**
+ * A projection that publishes membership and no pick at all — what the engine
+ * sends whenever nothing about these cards is currently choosable, which is most
+ * of the time. The badge and the fan read it either way.
+ */
+function membershipOnly(members: number[]): ViewerInteraction {
+  return interactionForAttachedObjects([], members);
+}
+
+/**
+ * The reported board: Slumbering Keepguard (`{2}{W}`: pump) enchanted by Cooped
+ * Up (`{2}{W}`: Exile enchanted creature). Cooped Up is deliberate — its
+ * ability is legitimately activatable FROM THE BATTLEFIELD, so the Aura being a
+ * live choice is CORRECT and the host's unreachability needs no engine defect
+ * to reproduce.
+ */
+function keepguardUnderCoopedUp(): GameState {
+  const keepguard = makeObject({
+    id: 1,
+    name: "Slumbering Keepguard",
+    attachments: [2],
+    power: 3,
+    toughness: 3,
+    base_power: 3,
+    base_toughness: 3,
+  });
+  const coopedUp = makeObject({
+    id: 2,
+    card_id: 200,
+    attached_to: { type: "Object", data: 1 },
+    attachments: [],
+    name: "Cooped Up",
+    power: null,
+    toughness: null,
+    base_power: null,
+    base_toughness: null,
+    card_types: { supertypes: [], core_types: ["Enchantment"], subtypes: ["Aura"] },
+    color: ["White"],
+    base_color: ["White"],
+  });
+
+  return buildGameState({
+    players: buildPlayers([0, 1]),
+    objects: buildObjectMap(keepguard, coopedUp),
+    battlefield: [1, 2],
+    exile: [],
+    stack: [],
+    waiting_for: buildPriorityWaitingFor(),
+  });
+}
+
 describe("PermanentCard", () => {
   beforeEach(() => {
     window.matchMedia = ((query: string) => ({
@@ -208,6 +276,12 @@ describe("PermanentCard", () => {
       legalActions: [],
       legalActionsByObject: {},
       spellCosts: {},
+      // Reset alongside the rest of the engine-published state: without this the
+      // rows that publish an attachment fan leak it into every later row, so the
+      // suite only passed because they happened to be declared last. Membership
+      // itself is always published — object 2 hangs on the host and object 3 on
+      // object 2 — because the fan and the badge now read it from here.
+      viewerInteraction: membershipOnly([2, 3]),
     });
     useUiStore.setState({
       selectedObjectId: null,
@@ -597,7 +671,7 @@ describe("PermanentCard", () => {
     renderPermanent();
 
     const button = screen.getByRole("button", {
-      name: "View Test Creature's attached card",
+      name: "View Test Creature's 2 attached cards",
     });
 
     fireEvent.pointerDown(button);
@@ -608,11 +682,45 @@ describe("PermanentCard", () => {
     expect(useUiStore.getState().inspectedObjectId).toBeNull();
   });
 
+  it("labels the fan control from the projected card count rather than raw attachments", () => {
+    const gameState = makeState();
+    gameState.objects[1].attachments = [2, 4];
+    gameState.objects[4] = makeObject({
+      id: 4,
+      card_id: 400,
+      attached_to: { type: "Object", data: 1 },
+      attachments: [],
+      name: "Second Equipment",
+      power: null,
+      toughness: null,
+      base_power: null,
+      base_toughness: null,
+      card_types: { supertypes: [], core_types: ["Artifact"], subtypes: ["Equipment"] },
+      color: [],
+      base_color: [],
+    });
+    gameState.battlefield = [1, 2, 3, 4];
+    useGameStore.setState({
+      gameState,
+      waitingFor: gameState.waiting_for,
+      viewerInteraction: membershipOnly([2]),
+    });
+    act(() => {
+      useUiStore.setState({ selectedObjectId: 1 });
+    });
+
+    renderPermanent();
+
+    expect(screen.getByRole("button", {
+      name: "View Test Creature's attached card",
+    })).toBeInTheDocument();
+  });
+
   it("keeps the single-attachment control readable at compact card sizes", () => {
     renderPermanent();
 
     const button = screen.getByRole("button", {
-      name: "View Test Creature's attached card",
+      name: "View Test Creature's 2 attached cards",
     });
 
     expect(button).toHaveStyle({
@@ -823,6 +931,202 @@ describe("PermanentCard", () => {
     expect(useUiStore.getState().attachmentFanHostId).toBeNull();
   });
 
+  /**
+   * Reported from a real game (Priority during Declare Blockers): Slumbering
+   * Keepguard's `{2}{W}` was unreachable while Cooped Up sat on it. Every click
+   * on the host — centre, edge, corner — opened the attachment chooser, and the
+   * chooser cannot pick the host by design (`AttachmentFan.tsx:241`,
+   * `id !== host.id`), so the host's own ability had no path at all.
+   *
+   * This is the SAME branch-order invariant the V13 arm above pins, on the OTHER
+   * source. Hunk B reads the affordance sets and sits LAST; the
+   * `attachmentsActionable` branch reads `viewerInteraction.attachmentFans` and
+   * USED TO sit above the activation branch, on the premise stated in its own
+   * comment — "the host is not a legal choice" — which is unchecked and false
+   * whenever Priority publishes the host as activatable too. It now sits below
+   * the host's own intent (`PermanentCard.tsx:694` activation, `:727` the fan
+   * branch, `:747` hunk B), which is what this row pins.
+   *
+   * COVERAGE GAP this closed: before this row, every interaction-fan test in
+   * this file called `renderPermanent()` with no arguments, so
+   * `activatableObjectIds` was empty in all of them and no arm held a fan AND an
+   * activatable host at once — which is precisely what
+   * `HumanResponseModel::ExactCandidates` publishes during Priority.
+   */
+  const keepguardPump = {
+    type: "ActivateAbility",
+    data: { source_id: 1, ability_index: 0 },
+  } as const;
+  const coopedUpExile = {
+    type: "ActivateAbility",
+    data: { source_id: 2, ability_index: 0 },
+  } as const;
+
+  it("activates the host's own ability while an attachment is a live interaction choice", () => {
+    const gameState = keepguardUnderCoopedUp();
+    useGameStore.setState({
+      gameState,
+      waitingFor: gameState.waiting_for,
+      viewerInteraction: interactionForAttachedObject(2),
+      legalActionsByObject: { "1": [keepguardPump], "2": [coopedUpExile] },
+    });
+    act(() => {
+      useUiStore.setState({ attachmentFanHostId: null, selectedObjectId: null });
+    });
+
+    const { container } = renderPermanent(new Set(), new Set(), new Set(), new Set([1, 2]));
+    clickHost(container);
+
+    expect(dispatchAction).toHaveBeenCalledWith(keepguardPump);
+    expect(useUiStore.getState().attachmentFanHostId).toBeNull();
+    // BRANCH DISCRIMINATOR: hunk B (`:747`) selects the host unconditionally, so
+    // a failure caused by THAT branch would leave `selectedObjectId === 1`.
+    // MEASURED on the DROP side (the fan branch restored above activation):
+    //   `dispatched: [] fanHostId: 1 selectedObjectId: null`
+    // — no selection, which only the `:727` branch produces, so the red state is
+    // attributable to it and not to hunk B. It also matches the reported
+    // screenshot: the host rendered dimmed and WITHOUT a selection ring. Left as
+    // evidence rather than an assertion: a fix must reach the ability, and
+    // whether it also selects the host is not this row's business.
+  });
+
+  // REACHABILITY GUARD for the reorder above. Handing the click back to the host
+  // is only correct if the attachments keep a route of their own. Two attachments
+  // that are both actionable auto-expand the stack, so `hiddenAttachmentCount`
+  // is 0 and the `+N` control is absent; the `⧉` control used to require exactly
+  // ONE attachment, leaving this state with no entry point at all and each Aura
+  // reachable only through a ~22px peek behind the host face.
+  //
+  // The reported board was Slumbering Keepguard under TWO Bestial Bloodline, but
+  // the fixture deliberately uses Cage of Hands (`{1}{W}: Return this Aura to its
+  // owner's hand`) as the second Aura: Bestial Bloodline's only activated ability
+  // works from the graveyard, so its appearing as a live choice on the
+  // battlefield is a separate engine defect (CR 113.6b). Pinning this row on two
+  // Auras that are legitimately activatable keeps it green once that is fixed.
+  it("keeps an explicit fan route on a host whose several attachments are all expanded", () => {
+    const gameState = keepguardUnderCoopedUp();
+    const secondAura = buildGameObject({
+      ...gameState.objects[2],
+      id: 3,
+      card_id: 300,
+      name: "Cage of Hands",
+    });
+    gameState.objects[1] = { ...gameState.objects[1], attachments: [2, 3] };
+    gameState.objects[3] = secondAura;
+    gameState.battlefield = [1, 2, 3];
+    useGameStore.setState({
+      gameState,
+      waitingFor: gameState.waiting_for,
+      viewerInteraction: interactionForAttachedObjects([2, 3]),
+      legalActionsByObject: { "1": [keepguardPump], "2": [coopedUpExile] },
+    });
+    act(() => {
+      useUiStore.setState({ attachmentFanHostId: null, selectedObjectId: null });
+    });
+
+    const { container } = renderPermanent(new Set(), new Set(), new Set(), new Set([1, 2, 3]));
+
+    // Both attachments are on the board, so nothing is hidden and no `+N` exists.
+    expect(container.querySelector('[data-object-id="2"]')).not.toBeNull();
+    expect(container.querySelector('[data-object-id="3"]')).not.toBeNull();
+
+    // Stated as its own claim so the red state reads "no explicit route exists"
+    // rather than as a selector that stopped matching.
+    // MEASURED (drop side — the control gated back on `attachments.length === 1`):
+    //   `Unable to find a label with the text of: /Slumbering Keepguard/`.
+    const fanControl = screen.queryByLabelText(/Slumbering Keepguard/, { selector: "button" });
+    expect(fanControl).not.toBeNull();
+
+    fireEvent.click(fanControl as HTMLElement);
+    expect(useUiStore.getState().attachmentFanHostId).toBe(1);
+  });
+
+  // The pair, and the guard on the reorder: when the host itself offers nothing
+  // the fan MUST still take the click, because the Aura's ability is only
+  // reachable through it.
+  //
+  // `selectedObjectId` is what makes this arm discriminating, and it is not
+  // decoration. `attachmentFanHostId === 1` alone is NOT enough: the
+  // affordance-set branch below (hunk B) produces the very same fan from the
+  // very same fixture, so deleting the branch under test left this row green.
+  // Only hunk B calls `selectObject`, so requiring NO selection is what proves
+  // the fan came from the interaction branch.
+  // MEASURED (drop side — the `attachmentsActionable` branch deleted):
+  //   `expected 1 to be null` on the selection assertion; hunk B answered the
+  //   click instead. Before that assertion existed the mutant was invisible here.
+  it("still opens the fan when only the attachment is a live interaction choice", () => {
+    const gameState = keepguardUnderCoopedUp();
+    useGameStore.setState({
+      gameState,
+      waitingFor: gameState.waiting_for,
+      viewerInteraction: interactionForAttachedObject(2),
+      legalActionsByObject: { "2": [coopedUpExile] },
+    });
+    act(() => {
+      useUiStore.setState({ attachmentFanHostId: null, selectedObjectId: null });
+    });
+
+    const { container } = renderPermanent(new Set(), new Set(), new Set(), new Set([2]));
+    clickHost(container);
+
+    expect(useUiStore.getState().attachmentFanHostId).toBe(1);
+    expect(dispatchAction).not.toHaveBeenCalled();
+    expect(useUiStore.getState().selectedObjectId).toBeNull();
+  });
+
+  // The two halves of the `⧉` gate, each pinned on its own. Without these the
+  // gate could be weakened to either disjunct alone and the whole board suite
+  // stayed green: dropping `attachmentsExpanded` puts a `⧉` on every permanent
+  // that has attachments including collapsed ones (two competing controls), and
+  // dropping `obj.attachments.length > 0` puts one on every permanent on the
+  // board, attachments or not.
+  it("hands the collapsed state to the +N control and renders no second route", () => {
+    const gameState = keepguardUnderCoopedUp();
+    const secondAura = buildGameObject({
+      ...gameState.objects[2],
+      id: 3,
+      card_id: 300,
+      name: "Cage of Hands",
+    });
+    gameState.objects[1] = { ...gameState.objects[1], attachments: [2, 3] };
+    gameState.objects[3] = secondAura;
+    gameState.battlefield = [1, 2, 3];
+    // No interaction fan and no selection, so nothing expands the stack.
+    useGameStore.setState({ gameState, waitingFor: gameState.waiting_for });
+    act(() => {
+      useUiStore.setState({ attachmentFanHostId: null, selectedObjectId: null });
+    });
+
+    renderPermanent();
+
+    expect(screen.queryByLabelText(/Slumbering Keepguard/, { selector: "button" })).toBeNull();
+    // Reach guard: proves the fixture really is collapsed rather than simply
+    // missing both controls for some unrelated reason.
+    expect(screen.getByText("+1")).toBeInTheDocument();
+  });
+
+  it("renders no fan route on a permanent that has no attachments", () => {
+    const gameState = keepguardUnderCoopedUp();
+    gameState.objects[1] = { ...gameState.objects[1], attachments: [] };
+    gameState.battlefield = [1];
+    // Nothing is attached, so the engine publishes no membership for this host —
+    // and the badge is gated on that, not on a scan of the snapshot.
+    useGameStore.setState({
+      gameState,
+      waitingFor: gameState.waiting_for,
+      viewerInteraction: membershipOnly([]),
+    });
+
+    const { container } = renderPermanent();
+
+    expect(screen.queryByLabelText(/Slumbering Keepguard/, { selector: "button" })).toBeNull();
+    expect(screen.queryByText(/^\+\d+$/)).toBeNull();
+    // Reach guard, matching the row above: both assertions are negative, so
+    // without this an early return (`PermanentCard.tsx:491`, `if (!obj)`) or any
+    // fixture drift would satisfy them for the wrong reason.
+    expect(container.querySelector('[data-object-id="1"]')).not.toBeNull();
+  });
+
   it("refreshes the attachment fan when the engine clears host attachments", () => {
     const gameState = makeState();
     const host = gameState.objects[1];
@@ -853,11 +1157,16 @@ describe("PermanentCard", () => {
       useGameStore.setState({
         gameState: nextState,
         waitingFor: nextState.waiting_for,
+        // The engine republishes membership with the state it belongs to; the
+        // fan follows that, not the raw `attachments` array.
+        viewerInteraction: membershipOnly([]),
       });
     });
 
-    expect(queryAllByLabelText("Test Creature").length).toBeGreaterThan(0);
+    // The last member left the battlefield, so the fan has nothing to spread and
+    // tears itself down rather than lingering as a lone host card over the board.
     expect(queryAllByLabelText("Test Equipment")).toHaveLength(0);
+    expect(queryAllByLabelText("Test Creature")).toHaveLength(0);
   });
 
   it("auto-expands collapsed attachments when one is a valid target", () => {
diff --git a/client/src/components/board/__tests__/abilityChoiceConsumerWiring.test.tsx b/client/src/components/board/__tests__/abilityChoiceConsumerWiring.test.tsx
index 94e9e455d3..5e8f441600 100644
--- a/client/src/components/board/__tests__/abilityChoiceConsumerWiring.test.tsx
+++ b/client/src/components/board/__tests__/abilityChoiceConsumerWiring.test.tsx
@@ -2,6 +2,7 @@ import { cleanup, fireEvent, render } from "@testing-library/react";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import type { GameAction, GameObject, GameState } from "../../../adapter/types.ts";
+import type { ViewerInteraction } from "../../../adapter/generated/interaction";
 import { dispatchAction, dispatchInteraction } from "../../../game/dispatch.ts";
 import { useGameStore } from "../../../stores/gameStore.ts";
 import { useUiStore } from "../../../stores/uiStore.ts";
@@ -140,7 +141,21 @@ function seed(legalActionsByObject: Record<string, GameAction[]>) {
     waitingFor: gameState.waiting_for,
     legalActions: [],
     legalActionsByObject,
-    viewerInteraction: null,
+    // Membership is engine-published on every projection, prompt or not, and the
+    // fan renders exactly that list — so the fixture has to carry it, with no
+    // pick attached (this row's clicks come from the legal-action buckets).
+    viewerInteraction: {
+      waitingForKind: { simultaneous: null, terminal: false, code: "choose" },
+      authorizedSubmitters: [0],
+      canSubmit: true,
+      autoPassRecommended: false,
+      opportunities: [],
+      attachmentFans: {},
+      attachmentViews: {
+        [HOST_ID]: { hostId: HOST_ID, cards: [{ objectId: FREED_ID, submission: null }] },
+      },
+      availability: { type: "inputRequired" },
+    } as unknown as ViewerInteraction,
   });
   // `enchantmentsDialogPlayer` is the OTHER input to `hasUiDialog`. Left
   // non-null it would raise the overlay on its own and the overlay assert
diff --git a/client/src/components/modal/__tests__/LoopShortcutModal.test.tsx b/client/src/components/modal/__tests__/LoopShortcutModal.test.tsx
index fb24035bdd..aefcf23329 100644
--- a/client/src/components/modal/__tests__/LoopShortcutModal.test.tsx
+++ b/client/src/components/modal/__tests__/LoopShortcutModal.test.tsx
@@ -58,6 +58,7 @@ function shortcutInteraction(
       },
     ],
     attachmentFans: {},
+  attachmentViews: {},
     availability: { type: "inputRequired" },
   };
 }
diff --git a/client/src/i18n/locales/de/game.json b/client/src/i18n/locales/de/game.json
index 9bdb47a100..702d4c847b 100644
--- a/client/src/i18n/locales/de/game.json
+++ b/client/src/i18n/locales/de/game.json
@@ -260,12 +260,16 @@
     "ringBearer": "Ring",
     "ringBearerTooltip": "Ringträger",
     "hiddenAttachments": "+{{count}} more attached",
+    "hiddenAttachmentsAria_few": "{{count}} verborgene angelegte Karten anzeigen",
+    "hiddenAttachmentsAria_many": "{{count}} verborgene angelegte Karten anzeigen",
     "hiddenAttachmentsAria_one": "{{count}} verborgene angelegte Karte anzeigen",
     "hiddenAttachmentsAria_other": "{{count}} verborgene angelegte Karten anzeigen",
     "fanPick": "Wählen",
     "fanConfirm": "Bestätigen ({{count}})",
     "viewAttachments_one": "Angelegte Karte ansehen",
     "viewAttachments_other": "{{count}} angelegte Karten ansehen",
+    "viewAttachmentsFor_few": "{{count}} angelegte Karten von {{name}} ansehen",
+    "viewAttachmentsFor_many": "{{count}} angelegte Karten von {{name}} ansehen",
     "viewAttachmentsFor_one": "Angelegte Karte von {{name}} ansehen",
     "viewAttachmentsFor_other": "{{count}} angelegte Karten von {{name}} ansehen",
     "hiddenExileCards": "+{{count}} more exiled",
diff --git a/client/src/i18n/locales/en/game.json b/client/src/i18n/locales/en/game.json
index d3285c72ac..9d9a7e3465 100644
--- a/client/src/i18n/locales/en/game.json
+++ b/client/src/i18n/locales/en/game.json
@@ -267,12 +267,16 @@
     "ringBearer": "Ring",
     "ringBearerTooltip": "Ring-bearer",
     "hiddenAttachments": "+{{count}} more attached",
+    "hiddenAttachmentsAria_few": "Show {{count}} hidden attached cards",
+    "hiddenAttachmentsAria_many": "Show {{count}} hidden attached cards",
     "hiddenAttachmentsAria_one": "Show {{count}} hidden attached card",
     "hiddenAttachmentsAria_other": "Show {{count}} hidden attached cards",
     "fanPick": "Pick",
     "fanConfirm": "Confirm ({{count}})",
     "viewAttachments_one": "View attached card",
     "viewAttachments_other": "View {{count}} attached cards",
+    "viewAttachmentsFor_few": "View {{name}}'s {{count}} attached cards",
+    "viewAttachmentsFor_many": "View {{name}}'s {{count}} attached cards",
     "viewAttachmentsFor_one": "View {{name}}'s attached card",
     "viewAttachmentsFor_other": "View {{name}}'s {{count}} attached cards",
     "hiddenExileCards": "+{{count}} more exiled",
diff --git a/client/src/i18n/locales/es/game.json b/client/src/i18n/locales/es/game.json
index 67ede2a701..ee216ea24e 100644
--- a/client/src/i18n/locales/es/game.json
+++ b/client/src/i18n/locales/es/game.json
@@ -260,12 +260,16 @@
     "ringBearer": "Anillo",
     "ringBearerTooltip": "Portador del Anillo",
     "hiddenAttachments": "+{{count}} more attached",
+    "hiddenAttachmentsAria_few": "Mostrar {{count}} cartas anexas ocultas",
+    "hiddenAttachmentsAria_many": "Mostrar {{count}} cartas anexas ocultas",
     "hiddenAttachmentsAria_one": "Mostrar {{count}} carta anexa oculta",
     "hiddenAttachmentsAria_other": "Mostrar {{count}} cartas anexas ocultas",
     "fanPick": "Elegir",
     "fanConfirm": "Confirmar ({{count}})",
     "viewAttachments_one": "Ver carta anexada",
     "viewAttachments_other": "Ver {{count}} cartas anexadas",
+    "viewAttachmentsFor_few": "Ver {{count}} cartas anexadas de {{name}}",
+    "viewAttachmentsFor_many": "Ver {{count}} cartas anexadas de {{name}}",
     "viewAttachmentsFor_one": "Ver carta anexada de {{name}}",
     "viewAttachmentsFor_other": "Ver {{count}} cartas anexadas de {{name}}",
     "hiddenExileCards": "+{{count}} more exiled",
diff --git a/client/src/i18n/locales/fr/game.json b/client/src/i18n/locales/fr/game.json
index e0bbb54da9..62a2304b79 100644
--- a/client/src/i18n/locales/fr/game.json
+++ b/client/src/i18n/locales/fr/game.json
@@ -260,12 +260,16 @@
     "ringBearer": "Anneau",
     "ringBearerTooltip": "Porteur de l'Anneau",
     "hiddenAttachments": "+{{count}} more attached",
+    "hiddenAttachmentsAria_few": "Afficher {{count}} cartes attachées masquées",
+    "hiddenAttachmentsAria_many": "Afficher {{count}} cartes attachées masquées",
     "hiddenAttachmentsAria_one": "Afficher {{count}} carte attachée masquée",
     "hiddenAttachmentsAria_other": "Afficher {{count}} cartes attachées masquées",
     "fanPick": "Choisir",
     "fanConfirm": "Confirmer ({{count}})",
     "viewAttachments_one": "Voir la carte attachée",
     "viewAttachments_other": "Voir {{count}} cartes attachées",
+    "viewAttachmentsFor_few": "Voir les {{count}} cartes attachées de {{name}}",
+    "viewAttachmentsFor_many": "Voir les {{count}} cartes attachées de {{name}}",
     "viewAttachmentsFor_one": "Voir la carte attachée de {{name}}",
     "viewAttachmentsFor_other": "Voir les {{count}} cartes attachées de {{name}}",
     "hiddenExileCards": "+{{count}} more exiled",
diff --git a/client/src/i18n/locales/it/game.json b/client/src/i18n/locales/it/game.json
index 0b0f514cbd..a97b671014 100644
--- a/client/src/i18n/locales/it/game.json
+++ b/client/src/i18n/locales/it/game.json
@@ -260,12 +260,16 @@
     "ringBearer": "Anello",
     "ringBearerTooltip": "Portatore dell'Anello",
     "hiddenAttachments": "+{{count}} more attached",
+    "hiddenAttachmentsAria_few": "Mostra {{count}} carte assegnate nascoste",
+    "hiddenAttachmentsAria_many": "Mostra {{count}} carte assegnate nascoste",
     "hiddenAttachmentsAria_one": "Mostra {{count}} carta assegnata nascosta",
     "hiddenAttachmentsAria_other": "Mostra {{count}} carte assegnate nascoste",
     "fanPick": "Scegli",
     "fanConfirm": "Conferma ({{count}})",
     "viewAttachments_one": "Mostra carta assegnata",
     "viewAttachments_other": "Mostra {{count}} carte assegnate",
+    "viewAttachmentsFor_few": "Mostra {{count}} carte assegnate a {{name}}",
+    "viewAttachmentsFor_many": "Mostra {{count}} carte assegnate a {{name}}",
     "viewAttachmentsFor_one": "Mostra carta assegnata a {{name}}",
     "viewAttachmentsFor_other": "Mostra {{count}} carte assegnate a {{name}}",
     "hiddenExileCards": "+{{count}} more exiled",
diff --git a/client/src/i18n/locales/pl/game.json b/client/src/i18n/locales/pl/game.json
index 4f1cedd660..72cd30d1bf 100644
--- a/client/src/i18n/locales/pl/game.json
+++ b/client/src/i18n/locales/pl/game.json
@@ -260,14 +260,18 @@
     "ringBearer": "Pierścień",
     "ringBearerTooltip": "Powiernik Pierścienia",
     "hiddenAttachments": "+{{count}} more attached",
+    "hiddenAttachmentsAria_few": "Pokaż {{count}} ukryte dołączone karty",
+    "hiddenAttachmentsAria_many": "Pokaż {{count}} ukrytych dołączonych kart",
     "hiddenAttachmentsAria_one": "Pokaż {{count}} ukrytą dołączoną kartę",
-    "hiddenAttachmentsAria_other": "Pokaż {{count}} ukryte dołączone karty",
+    "hiddenAttachmentsAria_other": "Pokaż {{count}} ukrytych dołączonych kart",
     "fanPick": "Wybierz",
     "fanConfirm": "Potwierdź ({{count}})",
     "viewAttachments_one": "Pokaż dołączoną kartę",
     "viewAttachments_other": "Pokaż dołączone karty ({{count}})",
+    "viewAttachmentsFor_few": "Pokaż {{count}} dołączone karty {{name}}",
+    "viewAttachmentsFor_many": "Pokaż {{count}} dołączonych kart {{name}}",
     "viewAttachmentsFor_one": "Pokaż dołączoną kartę {{name}}",
-    "viewAttachmentsFor_other": "Pokaż {{count}} dołączone karty {{name}}",
+    "viewAttachmentsFor_other": "Pokaż {{count}} dołączonych kart {{name}}",
     "hiddenExileCards": "+{{count}} more exiled",
     "sacrifice": "Sacrifice",
     "boardChoiceBadges": {
diff --git a/client/src/i18n/locales/pt/game.json b/client/src/i18n/locales/pt/game.json
index 4e347985e6..91acbfb55f 100644
--- a/client/src/i18n/locales/pt/game.json
+++ b/client/src/i18n/locales/pt/game.json
@@ -260,12 +260,16 @@
     "ringBearer": "Anel",
     "ringBearerTooltip": "Portador do Anel",
     "hiddenAttachments": "+{{count}} more attached",
+    "hiddenAttachmentsAria_few": "Mostrar {{count}} cartas anexadas ocultas",
+    "hiddenAttachmentsAria_many": "Mostrar {{count}} cartas anexadas ocultas",
     "hiddenAttachmentsAria_one": "Mostrar {{count}} carta anexada oculta",
     "hiddenAttachmentsAria_other": "Mostrar {{count}} cartas anexadas ocultas",
     "fanPick": "Escolher",
     "fanConfirm": "Confirmar ({{count}})",
     "viewAttachments_one": "Ver carta anexada",
     "viewAttachments_other": "Ver {{count}} cartas anexadas",
+    "viewAttachmentsFor_few": "Ver {{count}} cartas anexadas a {{name}}",
+    "viewAttachmentsFor_many": "Ver {{count}} cartas anexadas a {{name}}",
     "viewAttachmentsFor_one": "Ver carta anexada a {{name}}",
     "viewAttachmentsFor_other": "Ver {{count}} cartas anexadas a {{name}}",
     "hiddenExileCards": "+{{count}} more exiled",
diff --git a/client/src/network/__tests__/protocol.test.ts b/client/src/network/__tests__/protocol.test.ts
index e79d01179d..6e37b10492 100644
--- a/client/src/network/__tests__/protocol.test.ts
+++ b/client/src/network/__tests__/protocol.test.ts
@@ -36,8 +36,8 @@ const viewerInteractionWithProducedMana = {
 } as never;
 
 describe("encodeWireMessage / decodeWireMessage", () => {
-  it("pins the P2P wire protocol to v21", () => {
-    expect(WIRE_PROTOCOL_VERSION).toBe(21);
+  it("pins the P2P wire protocol to v22", () => {
+    expect(WIRE_PROTOCOL_VERSION).toBe(22);
   });
 
   it("defaults shortcut actions for a legacy payload created before the additive field", () => {
@@ -234,15 +234,15 @@ describe("encodeWireMessage / decodeWireMessage", () => {
   // and nothing about the version. Both halves here stamp LITERALS — a frame
   // built from WIRE_PROTOCOL_VERSION cannot tell a bumped client from an
   // unbumped one, which is why every other handshake fixture in the suite is
-  // useless as an instrument for a bump. Revert 21 → 20 and BOTH halves red:
-  // the v20 frame stops being refused, and the v21 frame stops being admitted.
-  // The admitting half is the reach-guard: without it "refuses v20" is also
+  // useless as an instrument for a bump. Revert 22 → 21 and BOTH halves red:
+  // the v21 frame stops being refused, and the v22 frame stops being admitted.
+  // The admitting half is the reach-guard: without it "refuses v21" is also
   // satisfied by a client that refuses everything.
-  it("refuses the previous wire protocol (v20) and admits its own (v21)", () => {
-    expect(() => validateMessage(setupFrameAt(20))).toThrow(/Wire protocol mismatch/);
-    expect(validateMessage(setupFrameAt(21))).toMatchObject({
+  it("refuses the previous wire protocol (v21) and admits its own (v22)", () => {
+    expect(() => validateMessage(setupFrameAt(21))).toThrow(/Wire protocol mismatch/);
+    expect(validateMessage(setupFrameAt(22))).toMatchObject({
       type: "game_setup",
-      wireProtocolVersion: 21,
+      wireProtocolVersion: 22,
     });
   });
 
diff --git a/client/src/network/protocol.ts b/client/src/network/protocol.ts
index 2399511c68..2febc35eca 100644
--- a/client/src/network/protocol.ts
+++ b/client/src/network/protocol.ts
@@ -80,6 +80,10 @@ export function legalActionsFromWire(wire: LegalActionsWire): LegalActionsResult
  * of silently corrupting state.
  *
  * Bumps to date:
+ *  22 — LegalActionsWire.viewerInteraction carries attachmentViews: the engine's
+ *       membership list for each host's attachment fan. It parses on a v21 peer
+ *       as an empty map, so the loss is silent — a guest paired with a v21 host
+ *       would simply find every attachment fan gone.
  *  21 — LegalActionsWire.viewerInteraction carries the loop-shortcut preview,
  *       and the state snapshot carries WaitingFor::LoopShortcut.declaration.
  *       Both are optional and parse on a v20 peer; the loss is silent, so the
@@ -116,7 +120,7 @@ export function legalActionsFromWire(wire: LegalActionsWire): LegalActionsResult
  *       sub-phase on WaitingFor::MulliganDecision; the MulliganBottomCards
  *       variant was removed
  */
-export const WIRE_PROTOCOL_VERSION = 21 as const;
+export const WIRE_PROTOCOL_VERSION = 22 as const;
 
 export type P2PMessage = P2PAuthorityWire & (
   | { type: "guest_deck"; deckData: unknown; displayName?: string; reservationToken?: string }
diff --git a/client/src/pages/__tests__/GamePage.projectedManaChoices.test.ts b/client/src/pages/__tests__/GamePage.projectedManaChoices.test.ts
index 083fd60d78..309d02f034 100644
--- a/client/src/pages/__tests__/GamePage.projectedManaChoices.test.ts
+++ b/client/src/pages/__tests__/GamePage.projectedManaChoices.test.ts
@@ -66,6 +66,7 @@ function interactionWith(choices: InteractionChoice[]): ViewerInteraction {
       },
     ],
     attachmentFans: {},
+  attachmentViews: {},
     availability: { type: "inputRequired" },
   };
 }
diff --git a/crates/engine/src/bin/interaction_bindings.rs b/crates/engine/src/bin/interaction_bindings.rs
index 97f3d208c7..6344ec8557 100644
--- a/crates/engine/src/bin/interaction_bindings.rs
+++ b/crates/engine/src/bin/interaction_bindings.rs
@@ -3,20 +3,21 @@ use std::path::{Path, PathBuf};
 use engine::types::interaction::{
     ActiveInteractionSlot, AggregateComparator, AmountAssignment, ConfirmSemantics,
     InteractionActionCode, InteractionAggregateFunction, InteractionAttachmentFan,
-    InteractionAttachmentFanChild, InteractionAvailability, InteractionChoice,
-    InteractionChoiceStatus, InteractionDamageAssignmentMode, InteractionGroupConstraint,
-    InteractionIntentCode, InteractionManaAbilityActivationScope, InteractionManaColor,
-    InteractionManaComparator, InteractionManaRestriction, InteractionManaSpecialAction,
-    InteractionManaSpellCostCriterion, InteractionManaZoneSpendPolarity, InteractionObjectProperty,
-    InteractionOpportunity, InteractionOpportunityResponse, InteractionOutcomeCode,
-    InteractionPresentationSurface, InteractionPreview, InteractionPreviewRequest,
-    InteractionPreviewStatus, InteractionProgress, InteractionReasonCode, InteractionRelation,
-    InteractionRelationConstraint, InteractionRelationSourceConstraint, InteractionResponse,
-    InteractionResponseSpec, InteractionRoleCode, InteractionShortcutCountSpec,
-    InteractionShortcutDecision, InteractionShortcutPin, InteractionShortcutPoint,
-    InteractionShortcutPointKind, InteractionShortcutPreview, InteractionShortcutPreviewEntry,
-    InteractionShortcutPreviewFamily, InteractionShortcutReply, InteractionShortcutResponseCode,
-    InteractionSlotKind, InteractionSubmission, InteractionSummaryCode, InteractionWaitingForCode,
+    InteractionAttachmentFanChild, InteractionAttachmentView, InteractionAttachmentViewCard,
+    InteractionAvailability, InteractionChoice, InteractionChoiceStatus,
+    InteractionDamageAssignmentMode, InteractionGroupConstraint, InteractionIntentCode,
+    InteractionManaAbilityActivationScope, InteractionManaColor, InteractionManaComparator,
+    InteractionManaRestriction, InteractionManaSpecialAction, InteractionManaSpellCostCriterion,
+    InteractionManaZoneSpendPolarity, InteractionObjectProperty, InteractionOpportunity,
+    InteractionOpportunityResponse, InteractionOutcomeCode, InteractionPresentationSurface,
+    InteractionPreview, InteractionPreviewRequest, InteractionPreviewStatus, InteractionProgress,
+    InteractionReasonCode, InteractionRelation, InteractionRelationConstraint,
+    InteractionRelationSourceConstraint, InteractionResponse, InteractionResponseSpec,
+    InteractionRoleCode, InteractionShortcutCountSpec, InteractionShortcutDecision,
+    InteractionShortcutPin, InteractionShortcutPoint, InteractionShortcutPointKind,
+    InteractionShortcutPreview, InteractionShortcutPreviewEntry, InteractionShortcutPreviewFamily,
+    InteractionShortcutReply, InteractionShortcutResponseCode, InteractionSlotKind,
+    InteractionSubmission, InteractionSummaryCode, InteractionWaitingForCode,
     InteractionWaitingForKind, InteractionZoneCode, SelectionConstraint, SimultaneousDecisionKind,
     ViewerInteraction,
 };
@@ -104,6 +105,8 @@ fn expected_bindings() -> String {
         InteractionOpportunity,
         InteractionAttachmentFanChild,
         InteractionAttachmentFan,
+        InteractionAttachmentViewCard,
+        InteractionAttachmentView,
         InteractionAvailability,
         ViewerInteraction,
         AmountAssignment,
diff --git a/crates/engine/src/game/interaction.rs b/crates/engine/src/game/interaction.rs
index 633c15b219..6e9e4d0c9f 100644
--- a/crates/engine/src/game/interaction.rs
+++ b/crates/engine/src/game/interaction.rs
@@ -37,17 +37,17 @@ use crate::types::identifiers::ObjectId;
 use crate::types::interaction::{
     ActiveInteractionSlot, AggregateComparator, AmountAssignment, ConfirmSemantics,
     InteractionActionCode, InteractionActionId, InteractionAggregateFunction,
-    InteractionAttachmentFan, InteractionAttachmentFanChild, InteractionAvailability,
-    InteractionChoice, InteractionChoiceId, InteractionChoiceStatus,
-    InteractionDamageAssignmentMode, InteractionGroupConstraint, InteractionId,
-    InteractionIntentCode, InteractionManaAbilityActivationScope, InteractionManaColor,
-    InteractionManaComparator, InteractionManaRestriction, InteractionManaSpecialAction,
-    InteractionManaSpellCostCriterion, InteractionManaZoneSpendPolarity, InteractionObjectProperty,
-    InteractionOpportunity, InteractionOpportunityResponse, InteractionOutcomeCode,
-    InteractionPresentationSurface, InteractionPreview, InteractionPreviewRequest,
-    InteractionPreviewStatus, InteractionProgress, InteractionReasonCode,
-    InteractionRelationConstraint, InteractionRelationSourceConstraint, InteractionResponse,
-    InteractionResponseSpec, InteractionRoleCode, InteractionSessionId,
+    InteractionAttachmentFan, InteractionAttachmentFanChild, InteractionAttachmentView,
+    InteractionAttachmentViewCard, InteractionAvailability, InteractionChoice, InteractionChoiceId,
+    InteractionChoiceStatus, InteractionDamageAssignmentMode, InteractionGroupConstraint,
+    InteractionId, InteractionIntentCode, InteractionManaAbilityActivationScope,
+    InteractionManaColor, InteractionManaComparator, InteractionManaRestriction,
+    InteractionManaSpecialAction, InteractionManaSpellCostCriterion,
+    InteractionManaZoneSpendPolarity, InteractionObjectProperty, InteractionOpportunity,
+    InteractionOpportunityResponse, InteractionOutcomeCode, InteractionPresentationSurface,
+    InteractionPreview, InteractionPreviewRequest, InteractionPreviewStatus, InteractionProgress,
+    InteractionReasonCode, InteractionRelationConstraint, InteractionRelationSourceConstraint,
+    InteractionResponse, InteractionResponseSpec, InteractionRoleCode, InteractionSessionId,
     InteractionShortcutCountSpec, InteractionShortcutDecision, InteractionShortcutPoint,
     InteractionShortcutPointKind, InteractionShortcutPreview, InteractionShortcutPreviewEntry,
     InteractionShortcutPreviewFamily, InteractionShortcutReply, InteractionShortcutResponseCode,
@@ -7420,71 +7420,92 @@ pub fn derive_viewer_interaction(
     viewer: PlayerId,
 ) -> ViewerInteraction {
     debug_assert_interaction_consistency(authoritative_state);
+    // Membership follows visibility, so it is built before any authorization,
+    // session or bounding gate and carried by every projection below. Overflow
+    // is a value here, not a silently emptied map: the finalizer is the only
+    // place allowed to decide what an unbounded projection becomes.
+    let attachment_views = attachment_views_for_viewer(filtered_state);
     let authorized_submitters = turn_control::authorized_submitters(authoritative_state);
     let can_submit = authorized_submitters.contains(&viewer);
     let kind = waiting_for_kind(&authoritative_state.waiting_for);
     if kind.terminal {
-        return ViewerInteraction {
-            waiting_for_kind: kind,
-            authorized_submitters: Vec::new(),
-            can_submit: false,
-            auto_pass_recommended: false,
-            opportunities: Vec::new(),
-            attachment_fans: BTreeMap::new(),
-            availability: InteractionAvailability::Terminal {
-                outcome: InteractionOutcomeCode::Terminal,
+        return finalize_viewer_interaction(
+            ViewerInteraction {
+                waiting_for_kind: kind,
+                authorized_submitters: Vec::new(),
+                can_submit: false,
+                auto_pass_recommended: false,
+                opportunities: Vec::new(),
+                attachment_fans: BTreeMap::new(),
+                attachment_views: BTreeMap::new(),
+                availability: InteractionAvailability::Terminal {
+                    outcome: InteractionOutcomeCode::Terminal,
+                },
             },
-        };
+            attachment_views.clone(),
+        );
     }
     if !can_submit {
-        return ViewerInteraction {
-            waiting_for_kind: kind,
-            authorized_submitters: authorized_submitters
-                .into_iter()
-                .map(|player| player.0)
-                .collect(),
-            can_submit: false,
-            auto_pass_recommended: false,
-            opportunities: Vec::new(),
-            attachment_fans: BTreeMap::new(),
-            availability: InteractionAvailability::Waiting,
-        };
+        return finalize_viewer_interaction(
+            ViewerInteraction {
+                waiting_for_kind: kind,
+                authorized_submitters: authorized_submitters
+                    .into_iter()
+                    .map(|player| player.0)
+                    .collect(),
+                can_submit: false,
+                auto_pass_recommended: false,
+                opportunities: Vec::new(),
+                attachment_fans: BTreeMap::new(),
+                attachment_views: BTreeMap::new(),
+                availability: InteractionAvailability::Waiting,
+            },
+            attachment_views.clone(),
+        );
     }
     if authoritative_state
         .interaction_session_id
         .as_ref()
         .is_none_or(|session| !interaction_session_is_valid(session))
     {
-        return ViewerInteraction {
-            waiting_for_kind: kind,
-            authorized_submitters: authorized_submitters
-                .into_iter()
-                .map(|player| player.0)
-                .collect(),
-            can_submit: true,
-            auto_pass_recommended: false,
-            opportunities: Vec::new(),
-            attachment_fans: BTreeMap::new(),
-            availability: InteractionAvailability::Unsupported {
-                reason: InteractionReasonCode::AuthorityUnbound,
+        return finalize_viewer_interaction(
+            ViewerInteraction {
+                waiting_for_kind: kind,
+                authorized_submitters: authorized_submitters
+                    .into_iter()
+                    .map(|player| player.0)
+                    .collect(),
+                can_submit: true,
+                auto_pass_recommended: false,
+                opportunities: Vec::new(),
+                attachment_fans: BTreeMap::new(),
+                attachment_views: BTreeMap::new(),
+                availability: InteractionAvailability::Unsupported {
+                    reason: InteractionReasonCode::AuthorityUnbound,
+                },
             },
-        };
+            attachment_views.clone(),
+        );
     }
     if !interaction_serial_is_valid(&authoritative_state.next_interaction_serial) {
-        return ViewerInteraction {
-            waiting_for_kind: kind,
-            authorized_submitters: authorized_submitters
-                .into_iter()
-                .map(|player| player.0)
-                .collect(),
-            can_submit: true,
-            auto_pass_recommended: false,
-            opportunities: Vec::new(),
-            attachment_fans: BTreeMap::new(),
-            availability: InteractionAvailability::Unsupported {
-                reason: InteractionReasonCode::InvalidAuthorityState,
+        return finalize_viewer_interaction(
+            ViewerInteraction {
+                waiting_for_kind: kind,
+                authorized_submitters: authorized_submitters
+                    .into_iter()
+                    .map(|player| player.0)
+                    .collect(),
+                can_submit: true,
+                auto_pass_recommended: false,
+                opportunities: Vec::new(),
+                attachment_fans: BTreeMap::new(),
+                attachment_views: BTreeMap::new(),
+                availability: InteractionAvailability::Unsupported {
+                    reason: InteractionReasonCode::InvalidAuthorityState,
+                },
             },
-        };
+            attachment_views.clone(),
+        );
     }
 
     let slots: Vec<_> = authoritative_state
@@ -7498,20 +7519,24 @@ pub fn derive_viewer_interaction(
         })
         .collect();
     if slots.len() > MAX_INTERACTION_LIST_LEN {
-        return ViewerInteraction {
-            waiting_for_kind: kind,
-            authorized_submitters: authorized_submitters
-                .into_iter()
-                .map(|player| player.0)
-                .collect(),
-            can_submit: true,
-            auto_pass_recommended: false,
-            opportunities: Vec::new(),
-            attachment_fans: BTreeMap::new(),
-            availability: InteractionAvailability::Unsupported {
-                reason: InteractionReasonCode::PayloadTooLarge,
+        return finalize_viewer_interaction(
+            ViewerInteraction {
+                waiting_for_kind: kind,
+                authorized_submitters: authorized_submitters
+                    .into_iter()
+                    .map(|player| player.0)
+                    .collect(),
+                can_submit: true,
+                auto_pass_recommended: false,
+                opportunities: Vec::new(),
+                attachment_fans: BTreeMap::new(),
+                attachment_views: BTreeMap::new(),
+                availability: InteractionAvailability::Unsupported {
+                    reason: InteractionReasonCode::PayloadTooLarge,
+                },
             },
-        };
+            attachment_views.clone(),
+        );
     }
     let mut opportunities = Vec::with_capacity(slots.len());
     let mut attachment_fans = BTreeMap::new();
@@ -7554,27 +7579,61 @@ pub fn derive_viewer_interaction(
     let availability = first_progress
         .or(first_fallback)
         .unwrap_or(default_availability);
-    let mut view = ViewerInteraction {
-        waiting_for_kind: kind,
-        authorized_submitters: authorized_submitters
-            .into_iter()
-            .map(|player| player.0)
-            .collect(),
-        can_submit: true,
-        auto_pass_recommended: matches!(
-            authoritative_state.waiting_for,
-            WaitingFor::Priority { .. }
-        ) && authoritative_state.auto_pass.contains_key(&viewer),
-        opportunities,
-        attachment_fans,
-        availability,
-    };
-    if bound_outbound_view(&view).is_err() {
+    let attachment_views = attachment_views.map(|mut views| {
+        bind_attachment_view_submissions(&mut views, &attachment_fans);
+        views
+    });
+    finalize_viewer_interaction(
+        ViewerInteraction {
+            waiting_for_kind: kind,
+            authorized_submitters: authorized_submitters
+                .into_iter()
+                .map(|player| player.0)
+                .collect(),
+            can_submit: true,
+            auto_pass_recommended: matches!(
+                authoritative_state.waiting_for,
+                WaitingFor::Priority { .. }
+            ) && authoritative_state.auto_pass.contains_key(&viewer),
+            opportunities,
+            attachment_fans,
+            attachment_views: BTreeMap::new(),
+            availability,
+        },
+        attachment_views,
+    )
+}
+
+/// The single exit of [`derive_viewer_interaction`]: every projection the engine
+/// hands outward — terminal, unauthorized, unbound-authority, invalid-serial,
+/// oversized-slot and the derived one alike — leaves through here, so one
+/// aggregate budget governs the whole payload. Membership is built before the
+/// authorization and session gates, so an early return carries just as much of
+/// it as the derived path does; charging it only on the derived path would leave
+/// the other five able to serialize an unbounded attachment tree.
+///
+/// Failing the budget fails closed: the unbounded lists are dropped and the
+/// availability states why, rather than shipping a truncated payload that reads
+/// as an authoritative "nothing is attached".
+///
+/// `attachment_views` arrives as the projection or as the reason it could not be
+/// produced within the bound, and is installed here rather than by the caller.
+/// A membership map that overflowed inside its own derivation is therefore just
+/// as visible to this gate as one that overflows the aggregate: both reach the
+/// same fail-closed answer, and neither can leave as a plausible empty map.
+fn finalize_viewer_interaction(
+    mut view: ViewerInteraction,
+    attachment_views: Result<BTreeMap<u64, InteractionAttachmentView>, InteractionReasonCode>,
+) -> ViewerInteraction {
+    let bounded = attachment_views.and_then(|views| {
+        view.attachment_views = views;
+        bound_outbound_view(&view)
+    });
+    if let Err(reason) = bounded {
         view.opportunities.clear();
         view.attachment_fans.clear();
-        view.availability = InteractionAvailability::Unsupported {
-            reason: InteractionReasonCode::PayloadTooLarge,
-        };
+        view.attachment_views.clear();
+        view.availability = InteractionAvailability::Unsupported { reason };
     }
     view
 }
@@ -7752,6 +7811,152 @@ fn attachment_fan_submission(
     })
 }
 
+/// Publish what is attached to every object the viewer can see.
+///
+/// Membership is a board fact — an attached permanent is an object in play
+/// (CR 301.5 / CR 303.4), not a property of the current prompt — so this reads
+/// the filtered projection alone and runs on every path, including the ones
+/// that carry no opportunity: an opponent's turn, an open prompt, a finished
+/// game. Publishing it only where picks exist would make an Aura disappear from
+/// the one surface that shows it as soon as a sibling Equipment became
+/// clickable.
+///
+/// Both directions of every relationship must agree, the same guard
+/// [`attachment_fans_for_object_choices`] applies, so authority-only or stale
+/// back-links cannot reach a consumer.
+///
+/// Overflow is returned, never absorbed. Dropping an oversized host or emptying
+/// an oversized map here would hand the caller a bounded, plausible projection
+/// that states the opposite of the truth — "nothing is attached" — and the
+/// budget gate downstream would have nothing left to object to. The reason code
+/// travels instead, and [`finalize_viewer_interaction`] decides what the viewer
+/// is told.
+fn attachment_views_for_viewer(
+    filtered_state: &GameState,
+) -> Result<BTreeMap<u64, InteractionAttachmentView>, InteractionReasonCode> {
+    let mut views = BTreeMap::new();
+    // Cards materialized so far, across every host. Charged BEFORE each subtree
+    // is built rather than measured after, so an over-budget projection is
+    // refused while it is still small.
+    //
+    // Every card the derivation emits is charged again by
+    // `bound_outbound_view`, alongside the map, the fans and the opportunities —
+    // so this running total can only ever be a LOWER bound on what the finalizer
+    // charges. That direction is what makes the early refusal safe: it can never
+    // reject a projection the finalizer would have accepted, and the finalizer
+    // stays the single authority on the answer the viewer is given.
+    let mut charged = 0usize;
+    for host_id in filtered_state.objects.keys().copied() {
+        let mut cards = Vec::new();
+        collect_attachment_subtree(filtered_state, host_id, charged, &mut cards)?;
+        if cards.is_empty() {
+            continue;
+        }
+        charged += cards.len();
+        views.insert(
+            host_id.0,
+            InteractionAttachmentView {
+                host_id: host_id.0,
+                cards: cards
+                    .into_iter()
+                    .map(|object_id| InteractionAttachmentViewCard {
+                        object_id: object_id.0,
+                        submission: None,
+                    })
+                    .collect(),
+            },
+        );
+    }
+    // Implied by the card charge — no view is inserted empty, so the map can
+    // never be longer than the cards already counted — but stated where the map
+    // is built so its own list bound does not have to be inferred.
+    if views.len() > MAX_INTERACTION_LIST_LEN {
+        return Err(InteractionReasonCode::PayloadTooLarge);
+    }
+    Ok(views)
+}
+
+/// Depth-first pre-order, so a nested attachment follows the card it hangs on
+/// and consumers can lay the subtree out without re-deriving its shape.
+///
+/// Iterative, with the frontier on the heap. The walk descends one level per
+/// nested attachment, and an attachment chain is only bounded by how many
+/// objects the game can grow, so recursion would put a game-controlled quantity
+/// on the call stack.
+///
+/// `already_charged` is what earlier hosts have spent, and the walk stops the
+/// moment this subtree carries the running total past the aggregate. An
+/// over-budget projection therefore costs one card more than the budget rather
+/// than its full size: the point of deriving membership is to publish it, and a
+/// projection that can no longer be published is not worth materializing.
+///
+/// The running total is compared by addition rather than by handing the walk a
+/// remaining allowance, so the bound cannot be expressed as a subtraction that
+/// underflows if the caller's accounting ever slips.
+fn collect_attachment_subtree(
+    filtered_state: &GameState,
+    host_id: ObjectId,
+    already_charged: usize,
+    out: &mut Vec<ObjectId>,
+) -> Result<(), InteractionReasonCode> {
+    // Seeded with the host: an attachment cycle would otherwise walk forever,
+    // and no host may appear as a card beneath itself.
+    let mut seen = HashSet::from([host_id]);
+    let mut frontier = vec![host_id];
+    while let Some(current) = frontier.pop() {
+        if current != host_id {
+            out.push(current);
+            if already_charged + out.len() > MAX_INTERACTION_LIST_LEN {
+                return Err(InteractionReasonCode::PayloadTooLarge);
+            }
+        }
+        let Some(object) = filtered_state.objects.get(&current) else {
+            continue;
+        };
+        // Pushed in reverse so the frontier pops them in the order the host
+        // lists them, which is what keeps the output in pre-order.
+        for child_id in object.attachments.iter().rev() {
+            let Some(child) = filtered_state.objects.get(child_id) else {
+                continue;
+            };
+            if !matches!(child.attached_to, Some(AttachTarget::Object(id)) if id == current) {
+                continue;
+            }
+            if !seen.insert(*child_id) {
+                continue;
+            }
+            frontier.push(*child_id);
+        }
+    }
+    Ok(())
+}
+
+/// Bind the published picks onto the membership the engine already owns.
+///
+/// The fans are keyed by the child's DIRECT host, so a card published beneath a
+/// nested attachment must still reach the view of the outermost host it hangs
+/// under. Object ids are unique, so a flat index is exact: it cannot move a
+/// pick onto a different card, and every host that legitimately lists the card
+/// gets the same submission.
+fn bind_attachment_view_submissions(
+    views: &mut BTreeMap<u64, InteractionAttachmentView>,
+    fans: &BTreeMap<u64, InteractionAttachmentFan>,
+) {
+    if fans.is_empty() {
+        return;
+    }
+    let submissions: HashMap<u64, &InteractionSubmission> = fans
+        .values()
+        .flat_map(|fan| fan.children.iter())
+        .map(|child| (child.object_id, &child.submission))
+        .collect();
+    for view in views.values_mut() {
+        for card in &mut view.cards {
+            card.submission = submissions.get(&card.object_id).map(|s| (*s).clone());
+        }
+    }
+}
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub struct InteractionSubmitError {
     pub code: InteractionReasonCode,
@@ -8063,6 +8268,17 @@ fn bound_outbound_view(view: &ViewerInteraction) -> Result<(), InteractionReason
             bound_outbound_response(&child.submission.response, &mut budget)?;
         }
     }
+    budget.list(view.attachment_views.len())?;
+    for attachment_view in view.attachment_views.values() {
+        budget.list(attachment_view.cards.len())?;
+        for card in &attachment_view.cards {
+            let Some(submission) = &card.submission else {
+                continue;
+            };
+            budget.string(submission.interaction_id.as_str())?;
+            bound_outbound_response(&submission.response, &mut budget)?;
+        }
+    }
     if let InteractionAvailability::ProgressAvailable { witness } = &view.availability {
         budget.string(witness.interaction_id.as_str())?;
         bound_outbound_response(&witness.response, &mut budget)?;
@@ -9733,4 +9949,82 @@ mod tests {
             );
         }
     }
+
+    /// The derivation itself, not the projection it feeds.
+    ///
+    /// `attachment_views_for_viewer` is the authority that decides whether the
+    /// membership can be published at all, and the public rows in
+    /// `interaction_contract` cannot see the difference this change makes: the
+    /// aggregate bound in `bound_outbound_view` already refused this payload, so
+    /// the ANSWER was fail-closed before and after. What changes is that the
+    /// refusal now happens while the projection is small.
+    ///
+    /// A chain of exactly `MAX_INTERACTION_LIST_LEN` links is the worst case and
+    /// the only one that discriminates: it is the LONGEST chain in which no
+    /// single host's subtree exceeds the per-view cap, so the per-host check
+    /// never fires and a derivation that measures afterwards runs to completion.
+    /// One link longer and the outermost view trips that cap on its own.
+    ///
+    /// REVERT-PROBE, RUN: drop the running charge in `collect_attachment_subtree`
+    /// and restore the post-walk `cards.len()` check ⇒ this returns `Ok` with
+    /// 49 995 000 card entries across 9 999 views (23.2 s, 7.4 GB resident on the
+    /// machine this was measured on) instead of `Err`.
+    #[test]
+    fn the_membership_derivation_refuses_a_worst_case_chain_before_building_it() {
+        use crate::game::game_object::GameObject;
+        use crate::types::identifiers::CardId;
+
+        let mut state = GameState::new_two_player(42);
+        let owner = PlayerId(0);
+        let mut previous: Option<ObjectId> = None;
+        for index in 0..=MAX_INTERACTION_LIST_LEN {
+            let id = ObjectId(index as u64 + 1);
+            let mut object = GameObject::new(
+                id,
+                CardId(index as u64 + 1),
+                owner,
+                format!("Chain Link {index}"),
+                Zone::Battlefield,
+            );
+            if let Some(host_id) = previous {
+                object.attached_to = Some(AttachTarget::Object(host_id));
+                state
+                    .objects
+                    .get_mut(&host_id)
+                    .expect("the host was inserted on the previous iteration")
+                    .attachments
+                    .push(id);
+            }
+            state.objects.insert(id, object);
+            state.battlefield.push_back(id);
+            previous = Some(id);
+        }
+
+        // Reach guard: the fixture really is one chain of the intended length,
+        // and every view in it would sit inside the per-view cap on its own —
+        // without this, an over-long fixture would fail for the wrong reason.
+        assert_eq!(state.objects.len(), MAX_INTERACTION_LIST_LEN + 1);
+        assert!(
+            state
+                .objects
+                .values()
+                .all(|object| object.attachments.len() <= 1),
+            "a chain, not a fan: no host may carry two attachments"
+        );
+
+        // Compared by discriminant, and reported by SIZE rather than by value:
+        // the `Ok` this row exists to reject holds 49 995 000 entries, and a
+        // failure that prints them is a failure nobody can read.
+        let derived = attachment_views_for_viewer(&state);
+        assert!(
+            matches!(derived, Err(InteractionReasonCode::PayloadTooLarge)),
+            "the derivation must refuse the payload itself rather than hand it to \
+             the finalizer to reject — got {} views totalling {} cards",
+            derived.as_ref().map_or(0, BTreeMap::len),
+            derived.as_ref().map_or(0, |views| views
+                .values()
+                .map(|view| view.cards.len())
+                .sum::<usize>()),
+        );
+    }
 }
diff --git a/crates/engine/src/types/interaction.rs b/crates/engine/src/types/interaction.rs
index e4a18c8652..11bb432273 100644
--- a/crates/engine/src/types/interaction.rs
+++ b/crates/engine/src/types/interaction.rs
@@ -1189,6 +1189,47 @@ pub struct InteractionAttachmentFan {
     pub children: Vec<InteractionAttachmentFanChild>,
 }
 
+/// One card in a host's attachment view, with the engine's own submission when
+/// a one-step pick was published for it and `None` when it was not.
+///
+/// `None` is not "unavailable": it means this projection publishes no direct
+/// pick, and the card's remaining affordances stay on the normal interaction
+/// surface. Membership does not depend on it.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "interaction-bindings", derive(ts_rs::TS))]
+#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "interaction-bindings", ts(rename_all = "camelCase"))]
+pub struct InteractionAttachmentViewCard {
+    #[cfg_attr(feature = "interaction-bindings", ts(type = "number"))]
+    pub object_id: u64,
+    pub submission: Option<InteractionSubmission>,
+}
+
+/// Viewer-scoped membership of one host's attachment subtree: what is attached
+/// to this object, in the order the engine lays it out, whatever the viewer may
+/// currently do about it.
+///
+/// This is deliberately a different question from [`InteractionAttachmentFan`],
+/// which publishes the picks the viewer is *authorized to submit right now*. An
+/// attached permanent is an object on the battlefield (CR 301.5 / CR 303.4), so
+/// its membership follows visibility, not authorization — it must survive an
+/// opponent's turn, a prompt that owns the waiting state, and a terminal game.
+/// Consumers render and count this list; they must never rebuild it by scanning
+/// `attachments`, which carries authority-only relationship data.
+///
+/// Every card here is validated in both directions (the host lists the child and
+/// the child points back at the host) and read only from the filtered
+/// projection.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "interaction-bindings", derive(ts_rs::TS))]
+#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "interaction-bindings", ts(rename_all = "camelCase"))]
+pub struct InteractionAttachmentView {
+    #[cfg_attr(feature = "interaction-bindings", ts(type = "number"))]
+    pub host_id: u64,
+    pub cards: Vec<InteractionAttachmentViewCard>,
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[cfg_attr(feature = "interaction-bindings", derive(ts_rs::TS))]
 #[serde(
@@ -1227,6 +1268,14 @@ pub struct ViewerInteraction {
         ts(type = "Record<number, InteractionAttachmentFan>")
     )]
     pub attachment_fans: BTreeMap<u64, InteractionAttachmentFan>,
+    /// What is attached to each visible object, keyed by that object. Published
+    /// on every projection, including the ones that carry no opportunity at all.
+    #[serde(default)]
+    #[cfg_attr(
+        feature = "interaction-bindings",
+        ts(type = "Record<number, InteractionAttachmentView>")
+    )]
+    pub attachment_views: BTreeMap<u64, InteractionAttachmentView>,
     pub availability: InteractionAvailability,
 }
 
diff --git a/crates/engine/tests/integration/interaction_contract.rs b/crates/engine/tests/integration/interaction_contract.rs
index 7c9f9f9e3f..ff087760d3 100644
--- a/crates/engine/tests/integration/interaction_contract.rs
+++ b/crates/engine/tests/integration/interaction_contract.rs
@@ -458,6 +458,442 @@ fn attachment_fans_are_per_interaction_filtered_and_direct() {
     );
 }
 
+/// Attaches `attachment` to `host` and asserts the engine wrote both directions
+/// of the relationship, so a later membership assertion cannot pass on a
+/// half-built fixture.
+fn attach_and_assert_linked(state: &mut GameState, attachment: ObjectId, host: ObjectId) {
+    engine::game::effects::attach::attach_to(state, attachment, host);
+    assert!(
+        state.objects[&host].attachments.contains(&attachment),
+        "fixture guard: the host must list its attachment"
+    );
+    assert_eq!(
+        state.objects[&attachment].attached_to,
+        Some(engine::game::game_object::AttachTarget::Object(host)),
+        "fixture guard: the attachment must point back at its host"
+    );
+}
+
+/// A host wearing two attachments, one of them itself a host, with exactly one
+/// published pick in the whole subtree.
+///
+/// This is the shape that made membership and affordance look like one question:
+/// the engine publishes a fan per DIRECT host and only for a child with exactly
+/// one legal choice, so a consumer that read the fans as the membership list
+/// dropped the two cards nothing was published for — off the only surface that
+/// shows what is attached at all.
+#[test]
+fn attachment_views_publish_the_whole_subtree_whatever_is_pickable() {
+    let mut scenario = GameScenario::new();
+    scenario.at_phase(Phase::PreCombatMain);
+    let host = scenario.add_creature(P0, "View Host", 2, 2).id();
+    let inner = scenario.add_creature(P0, "View Inner", 1, 1).id();
+    let nested = scenario.add_creature(P0, "View Nested", 1, 1).id();
+    let sibling = scenario.add_creature(P0, "View Sibling", 1, 1).id();
+    let mut runner = scenario.build();
+    {
+        let state = runner.state_mut();
+        attach_and_assert_linked(state, inner, host);
+        attach_and_assert_linked(state, nested, inner);
+        attach_and_assert_linked(state, sibling, host);
+        state.objects.get_mut(&nested).unwrap().tapped = true;
+        // Only the nested card is a candidate, so only the INTERMEDIATE host
+        // gets a fan — the outer host gets none at all.
+        state.waiting_for = WaitingFor::ChooseUntapSubset {
+            player: P0,
+            group: vec![nested],
+            max: 1,
+        };
+        bind(state, "attachment-view");
+    }
+
+    let view = priority_view(runner.state());
+    assert_eq!(
+        view.attachment_fans.keys().copied().collect::<Vec<_>>(),
+        vec![inner.0],
+        "reach guard: the engine publishes its pick under the direct host only"
+    );
+
+    let outer = view
+        .attachment_views
+        .get(&host.0)
+        .expect("the outer host publishes its own membership");
+    assert_eq!(
+        outer
+            .cards
+            .iter()
+            .map(|card| card.object_id)
+            .collect::<Vec<_>>(),
+        vec![inner.0, nested.0, sibling.0],
+        "membership is the whole subtree in depth-first order, not the published picks"
+    );
+    assert!(
+        outer.cards[0].submission.is_none() && outer.cards[2].submission.is_none(),
+        "a card the engine published no pick for is still a member, without a submission"
+    );
+    let nested_submission = outer.cards[1]
+        .submission
+        .clone()
+        .expect("a pick published under a nested host reaches the outer host's view");
+
+    let intermediate = view
+        .attachment_views
+        .get(&inner.0)
+        .expect("an attachment that is itself a host publishes its own membership");
+    assert_eq!(
+        intermediate
+            .cards
+            .iter()
+            .map(|card| card.object_id)
+            .collect::<Vec<_>>(),
+        vec![nested.0],
+        "a nested host lists what hangs on it, and never itself"
+    );
+
+    submit_interaction(runner.state_mut(), P0, nested_submission).expect(
+        "the submission published in the view resolves through production interaction dispatch",
+    );
+    assert!(
+        !runner.state().objects[&nested].tapped,
+        "the nested card's published submission applies its selected untap"
+    );
+}
+
+/// Membership answers a different question than the fan does, and must not
+/// inherit its authorization gate: an attached permanent is an object in play
+/// (CR 301.5 / CR 303.4), so it stays visible while another player holds the
+/// turn. Both directions of the relationship still have to agree.
+#[test]
+fn attachment_views_follow_visibility_while_fans_follow_authorization() {
+    let mut scenario = GameScenario::new();
+    scenario.at_phase(Phase::PreCombatMain);
+    let host = scenario.add_creature(P0, "Link Host", 2, 2).id();
+    let attachment = scenario.add_creature(P0, "Link Attachment", 1, 1).id();
+    let mut runner = scenario.build();
+    {
+        let state = runner.state_mut();
+        attach_and_assert_linked(state, attachment, host);
+        state.objects.get_mut(&attachment).unwrap().tapped = true;
+        state.waiting_for = WaitingFor::ChooseUntapSubset {
+            player: P0,
+            group: vec![attachment],
+            max: 1,
+        };
+        bind(state, "attachment-view-links");
+    }
+
+    let unauthorized = viewer_interaction(runner.state(), P1);
+    assert!(
+        unauthorized.attachment_fans.is_empty(),
+        "reach guard: the pick sidecar stays authorization-scoped"
+    );
+    let opponent_view = unauthorized
+        .attachment_views
+        .get(&host.0)
+        .expect("the opponent still sees what is attached to a battlefield permanent");
+    assert_eq!(
+        opponent_view
+            .cards
+            .iter()
+            .map(|card| card.object_id)
+            .collect::<Vec<_>>(),
+        vec![attachment.0]
+    );
+    assert!(
+        opponent_view.cards[0].submission.is_none(),
+        "a viewer who may not submit is offered nothing to submit"
+    );
+
+    let mut stale_back_link = filter_state_for_viewer(runner.state(), P0);
+    stale_back_link
+        .objects
+        .get_mut(&host)
+        .expect("fixture host remains visible")
+        .attachments
+        .clear();
+    assert!(
+        derive_viewer_interaction(runner.state(), &stale_back_link, P0)
+            .attachment_views
+            .is_empty(),
+        "a host that no longer lists the attachment publishes no membership for it"
+    );
+
+    let mut stale_forward_link = filter_state_for_viewer(runner.state(), P0);
+    stale_forward_link
+        .objects
+        .get_mut(&attachment)
+        .expect("fixture attachment remains visible")
+        .attached_to = None;
+    assert!(
+        derive_viewer_interaction(runner.state(), &stale_forward_link, P0)
+            .attachment_views
+            .is_empty(),
+        "an attachment that no longer points back at its host publishes no membership"
+    );
+}
+
+/// The projection crosses the generated adapter as the client reads it: camel
+/// case on the wire, a `null` submission for a card with no published pick.
+#[test]
+fn attachment_views_survive_the_adapter_round_trip() {
+    let mut scenario = GameScenario::new();
+    scenario.at_phase(Phase::PreCombatMain);
+    let host = scenario.add_creature(P0, "Wire Host", 2, 2).id();
+    let attachment = scenario.add_creature(P0, "Wire Attachment", 1, 1).id();
+    let mut runner = scenario.build();
+    {
+        let state = runner.state_mut();
+        attach_and_assert_linked(state, attachment, host);
+        bind(state, "attachment-view-wire");
+    }
+
+    let view = priority_view(runner.state());
+    assert!(view.attachment_views.contains_key(&host.0));
+    let wire = serde_json::to_string(&view).expect("serialize the viewer projection");
+    assert!(
+        wire.contains("\"attachmentViews\"") && wire.contains("\"objectId\""),
+        "the adapter reads camel case: {wire}"
+    );
+    assert!(
+        wire.contains("\"submission\":null"),
+        "a member with no published pick crosses the wire as null: {wire}"
+    );
+    let decoded: engine::types::interaction::ViewerInteraction =
+        serde_json::from_str(&wire).expect("deserialize the viewer projection");
+    assert_eq!(decoded.attachment_views, view.attachment_views);
+
+    // A projection written before this field existed still loads.
+    let mut legacy: serde_json::Value = serde_json::from_str(&wire).expect("reparse as value");
+    legacy
+        .as_object_mut()
+        .expect("the projection is an object")
+        .remove("attachmentViews");
+    let legacy: engine::types::interaction::ViewerInteraction =
+        serde_json::from_value(legacy).expect("a projection without the field still loads");
+    assert!(legacy.attachment_views.is_empty());
+}
+
+/// Hangs one more copy of the engine-written attachment `seed` on `host`,
+/// writing both directions exactly as `attach::attach_to` wrote them for the
+/// seed itself. Cloning rather than re-attaching keeps a ten-thousand-row
+/// fixture cheap without inventing a relationship shape of its own.
+fn clone_attachment_onto(
+    state: &mut GameState,
+    seed: ObjectId,
+    host: ObjectId,
+    next_id: &mut u64,
+) -> ObjectId {
+    let id = ObjectId(*next_id);
+    *next_id += 1;
+    let mut copy = state.objects[&seed].clone();
+    copy.id = id;
+    copy.attachments.clear();
+    copy.attached_to = Some(engine::game::game_object::AttachTarget::Object(host));
+    state.objects.insert(id, copy);
+    state.battlefield.push_back(id);
+    state
+        .objects
+        .get_mut(&host)
+        .expect("host exists")
+        .attachments
+        .push(id);
+    id
+}
+
+fn next_object_id(state: &GameState) -> u64 {
+    state.objects.keys().map(|id| id.0).max().unwrap_or(0) + 1
+}
+
+/// Membership is derived before the authorization, session and slot gates, so
+/// an early return carries as much of it as the derived path does. Only the
+/// whole-projection bound charges the map and every card in it: each view below
+/// is inside the per-view cap, and it is their SUM that has to fail closed —
+/// otherwise a viewer who may not submit anything at all still receives an
+/// attachment tree of unbounded size.
+///
+/// The same early return ships its membership normally while it fits — that is
+/// `attachment_views_follow_visibility_while_fans_follow_authorization`.
+#[test]
+fn an_early_return_fails_closed_on_the_aggregate_attachment_budget() {
+    let mut scenario = GameScenario::new();
+    scenario.at_phase(Phase::PreCombatMain);
+    let host = scenario.add_creature(P0, "Budget Host", 2, 2).id();
+    let seed = scenario.add_creature(P0, "Budget Attachment", 1, 1).id();
+    let mut runner = scenario.build();
+    {
+        let state = runner.state_mut();
+        attach_and_assert_linked(state, seed, host);
+        // Fill the host to the per-view maximum, so no single view is oversized
+        // on its own and only the aggregate can object.
+        let mut next_id = next_object_id(state);
+        while state.objects[&host].attachments.len() < MAX_INTERACTION_LIST_LEN {
+            clone_attachment_onto(state, seed, host, &mut next_id);
+        }
+        bind(state, "attachment-view-budget");
+    }
+    assert!(
+        runner.state().objects[&host]
+            .attachments
+            .iter()
+            .all(|id| runner.state().objects[id].attached_to
+                == runner.state().objects[&seed].attached_to),
+        "fixture guard: every filled row carries the same back-link the engine wrote"
+    );
+
+    let unauthorized = viewer_interaction(runner.state(), P1);
+    assert_eq!(
+        unauthorized.availability,
+        InteractionAvailability::Unsupported {
+            reason: InteractionReasonCode::PayloadTooLarge,
+        },
+        "an early return that cannot be bounded says so instead of shipping the payload"
+    );
+    assert!(
+        unauthorized.attachment_views.is_empty()
+            && unauthorized.attachment_fans.is_empty()
+            && unauthorized.opportunities.is_empty(),
+        "failing the budget drops every unbounded list rather than truncating one"
+    );
+    assert!(
+        !unauthorized.can_submit,
+        "the fail-closed projection keeps the authority answer it was already carrying"
+    );
+}
+
+/// A single direct host whose own subtree passes the per-view cap.
+///
+/// This shape used to be absorbed inside the membership derivation — the host
+/// was skipped, and an over-limit host map was replaced by an empty one — which
+/// handed the budget gate a small, plausible projection it had no reason to
+/// reject. The viewer then read a bounded empty map as an authoritative
+/// "nothing is attached", which is the one answer the engine must never invent.
+///
+/// Read through the unauthorized early return, which is the cheap seat: the
+/// derived path would enumerate every legal action over ten thousand
+/// permanents, and `a_deep_attachment_chain_fails_closed_on_the_aggregate`
+/// already carries the same claim through it.
+#[test]
+fn an_oversized_attachment_tree_fails_closed_instead_of_publishing_an_empty_map() {
+    let mut scenario = GameScenario::new();
+    scenario.at_phase(Phase::PreCombatMain);
+    let host = scenario.add_creature(P0, "Wide Host", 2, 2).id();
+    let seed = scenario.add_creature(P0, "Wide Attachment", 1, 1).id();
+    let mut runner = scenario.build();
+    {
+        let state = runner.state_mut();
+        attach_and_assert_linked(state, seed, host);
+        let mut next_id = next_object_id(state);
+        while state.objects[&host].attachments.len() <= MAX_INTERACTION_LIST_LEN {
+            clone_attachment_onto(state, seed, host, &mut next_id);
+        }
+        bind(state, "attachment-view-wide");
+    }
+    let wide = viewer_interaction(runner.state(), P1);
+    assert_eq!(
+        wide.availability,
+        InteractionAvailability::Unsupported {
+            reason: InteractionReasonCode::PayloadTooLarge,
+        },
+        "a host whose own subtree is over the cap fails closed; it is not skipped"
+    );
+    assert!(wide.attachment_views.is_empty() && wide.opportunities.is_empty());
+}
+
+/// The nesting half of the same claim, read through the DERIVED path: every
+/// view is small, and it is the tree that is too large.
+///
+/// A chain is the shape where the derivation's own cost is quadratic — every
+/// ancestor carries the whole tail beneath it — so the row is also the one that
+/// says the budget is charged while membership is derived rather than after it.
+/// At this depth the finished payload would hold 499 500 cards; the derivation
+/// stops one card past the aggregate instead.
+///
+/// The depth is capped by what the derived path costs elsewhere, not by what the
+/// walk costs: enumerating every legal action over the chain is quadratic too,
+/// and measured on this fixture it runs 1 s at 1 000 links, 14 s at 3 000 and
+/// 109 s at 10 000. `a_cap_depth_attachment_chain_is_refused_before_it_is_built`
+/// carries the depth claim past that ceiling through the cheap seat.
+#[test]
+fn a_deep_attachment_chain_fails_closed_on_the_aggregate() {
+    const CHAIN: usize = 1_000;
+    let mut scenario = GameScenario::new();
+    scenario.at_phase(Phase::PreCombatMain);
+    let root = scenario.add_creature(P0, "Chain Root", 2, 2).id();
+    let seed = scenario.add_creature(P0, "Chain Link", 1, 1).id();
+    let mut runner = scenario.build();
+    {
+        let state = runner.state_mut();
+        attach_and_assert_linked(state, seed, root);
+        let mut next_id = next_object_id(state);
+        let mut tip = seed;
+        for _ in 1..CHAIN {
+            tip = clone_attachment_onto(state, seed, tip, &mut next_id);
+        }
+        bind(state, "attachment-view-deep");
+    }
+    let deep = priority_view(runner.state());
+    assert_eq!(
+        deep.availability,
+        InteractionAvailability::Unsupported {
+            reason: InteractionReasonCode::PayloadTooLarge,
+        },
+        "nesting sums the same way: {CHAIN} views of at most {CHAIN} cards each \
+         exceed the aggregate even though none exceeds the per-view cap"
+    );
+    assert!(deep.attachment_views.is_empty());
+}
+
+/// The depth half, at the worst depth there is: a chain exactly
+/// `MAX_INTERACTION_LIST_LEN` links long is the LONGEST one in which no single
+/// view exceeds the per-view cap, so it is precisely the shape a per-host check
+/// cannot catch. One link shorter and the aggregate is smaller; one longer and
+/// the outermost view trips the per-view cap on its own and the derivation stops
+/// at the first host. This is the depth the engine permits, too — CR 732.2's
+/// runaway-cascade guard (`MAX_OBJECT_GROWTH`, `game::engine`) lets one dispatch
+/// grow the board by 16 000 objects.
+///
+/// The finished payload here holds 49 995 000 cards, the prefix sums of every
+/// nested view. Measured on this fixture, deriving membership in full and
+/// measuring afterwards costs 23.2 s and peaks at 7.4 GB resident; charging the
+/// aggregate as the walk goes costs 0.16 s and 4.7 GB, which is the fixture
+/// itself. The engine ships to WASM, where that difference is linear-memory
+/// exhaustion rather than a slow frame.
+///
+/// The answer is the same either way — the finalizer always refused this payload
+/// — so the row asserts the answer and the cost above is what the change is for.
+/// Read through the unauthorized early return, which reaches the same membership
+/// derivation without the action enumeration the derived path owes over ten
+/// thousand permanents (109 s, measured); the row above carries the same
+/// fail-closed answer through the derived path at an affordable depth.
+#[test]
+fn a_cap_depth_attachment_chain_is_refused_before_it_is_built() {
+    const CHAIN: usize = MAX_INTERACTION_LIST_LEN;
+    let mut scenario = GameScenario::new();
+    scenario.at_phase(Phase::PreCombatMain);
+    let root = scenario.add_creature(P0, "Cap Depth Root", 2, 2).id();
+    let seed = scenario.add_creature(P0, "Cap Depth Link", 1, 1).id();
+    let mut runner = scenario.build();
+    {
+        let state = runner.state_mut();
+        attach_and_assert_linked(state, seed, root);
+        let mut next_id = next_object_id(state);
+        let mut tip = seed;
+        for _ in 1..CHAIN {
+            tip = clone_attachment_onto(state, seed, tip, &mut next_id);
+        }
+        bind(state, "attachment-view-cap-depth");
+    }
+    let deep = viewer_interaction(runner.state(), P1);
+    assert_eq!(
+        deep.availability,
+        InteractionAvailability::Unsupported {
+            reason: InteractionReasonCode::PayloadTooLarge,
+        },
+        "a chain {CHAIN} links deep is refused, not walked to the bottom"
+    );
+    assert!(deep.attachment_views.is_empty() && deep.opportunities.is_empty());
+}
+
 #[test]
 fn authority_requires_explicit_binding_and_rebinding_invalidates_old_capabilities() {
     let mut state = GameState::new_two_player(42);