From 4a89cb643427698734f9942c4a37ecfe74a4290c Mon Sep 17 00:00:00 2001
From: cuinhellcat <217210902+cuinhellcat@users.noreply.github.com>
Date: Wed, 12 Aug 2026 10:46:55 +0200
Subject: [PATCH 1/8] fix(client): give a host's own click back to the host,
 and keep a fan route
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A creature's activated ability was unreachable whenever an attached Aura or
Equipment was activatable too. Reported for Slumbering Keepguard (`{2}{W}`);
reproduces with Cooped Up, whose `{2}{W}: Exile enchanted creature` is
legitimately activatable from the battlefield, so no engine defect is needed.

During Priority `HumanResponseModel::ExactCandidates` publishes an attachment
fan for every activatable attachment, so `viewerInteraction.attachmentFans`
carries an entry for the host. The `attachmentsActionable` branch read that as
"the host is not a legal choice" — an unchecked premise — and sat above the
activation branch, so every click on the host opened the chooser instead. The
chooser excludes the host by design (`id !== host.id`), so the host's ability
had no path at all. The sibling branch that reads the affordance sets is placed
last for exactly this reason and documents it; this one was not.

Moved below the host's own target / activation / undo intent, which also makes
the click ladder match the glow-ring priority ladder it advertises. Introduced
by #6945 (a card PR), which is why the click order was never reviewed as such.

Handing the click back to the host strands the attachments unless they keep a
route of their own, and they had none in this state: `attachmentsActionable` is
itself one of the disjuncts that expands the attachment stack, so no `+N`
control renders, while the `⧉` control required exactly one attachment. Each
Aura was then reachable only through a ~22px peek behind the host face. `⧉` now
renders whenever attachments are present and the stack is expanded — the same
predicate `+N` is derived from, so the two are complementary and exactly one
route exists in every state that needs one.

The `⧉` label counts what the fan will actually show
(`interactionAttachmentFan?.children.length`), not `obj.attachments.length`:
while an interaction is live the fan builds its cards from the projection, so
counting the raw snapshot would promise more cards than appear, and would
rediscover from the snapshot what the note above that line forbids.

`permanent.viewAttachmentsFor` now interpolates a real count, which exposed a
missing CLDR plural category: Polish selects `few`/`many` at 2/3/5 and neither
key existed, so `pl` fell back to English. Added `_few`/`_many` in all seven
catalogs (never selected outside `pl`, required by the `en`-oracle parity gate).
`permanent.hiddenAttachmentsAria` carried the identical defect and is fixed in
the same pass rather than left as the odd one out of a two-member class.

The control's SIZE is deliberately unchanged. It is now the pointer route where
the host's own click used to open the fan, and at `clamp(20px, …, 28px)` it is
under the 44px touch floor the branch above cites — but 44px is unreachable at
this seam: battlefield cards sit in an 8px gap and `--card-base` floors at
3.5rem, so growing outward puts ~26px over the NEIGHBOUR's face at `z-40` and
steals its clicks, while growing inward swallows most of a 56px card. Either
would re-create the click theft this commit undoes. Recorded at the gate as a
known limitation needing a layout-level answer, alongside the same gap on `+N`.

Also resets `viewerInteraction` in the test suite's shared setup — without it
the rows that publish a fan leak it into every later row, and the suite only
passed because they were declared last.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 client/src/components/board/PermanentCard.tsx |  71 +++++-
 .../board/__tests__/PermanentCard.test.tsx    | 236 ++++++++++++++++++
 client/src/i18n/locales/de/game.json          |   4 +
 client/src/i18n/locales/en/game.json          |   4 +
 client/src/i18n/locales/es/game.json          |   4 +
 client/src/i18n/locales/fr/game.json          |   4 +
 client/src/i18n/locales/it/game.json          |   4 +
 client/src/i18n/locales/pl/game.json          |   8 +-
 client/src/i18n/locales/pt/game.json          |   4 +
 9 files changed, 328 insertions(+), 11 deletions(-)

diff --git a/client/src/components/board/PermanentCard.tsx b/client/src/components/board/PermanentCard.tsx
index 44930fbe14..66f5a115fa 100644
--- a/client/src/components/board/PermanentCard.tsx
+++ b/client/src/components/board/PermanentCard.tsx
@@ -517,6 +517,14 @@ export const PermanentCard = memo(function PermanentCard({
   const attachmentPathIds = new Set([...attachmentRenderPath, objectId]);
   const renderableAttachmentIds = visibleAttachmentIds.filter((id) => !attachmentPathIds.has(id));
   const hiddenAttachmentCount = obj.attachments.length - visibleAttachmentIds.length;
+  // What the fan will actually put on screen, for the `⧉` control's label. While
+  // an interaction is live `AttachmentFan` builds its cards from the projection's
+  // children, not from `obj.attachments`, so counting the raw snapshot here would
+  // promise more cards than the fan shows (an Aura + an Equipment where only the
+  // Equipment is a legal choice reads "2 attached cards" over a one-card fan) —
+  // and would rediscover from the snapshot exactly what the note above forbids.
+  const attachmentFanCardCount =
+    interactionAttachmentFan?.children.length ?? obj.attachments.length;
   const exileLinksExpanded = exileLinks.length <= 1 || isHovered || isSelected || isInspected;
   const visibleExileLinks = exileLinksExpanded ? exileLinks : exileLinks.slice(0, 1);
   const hiddenExileCount = exileLinks.length - visibleExileLinks.length;
@@ -684,12 +692,6 @@ export const PermanentCard = memo(function PermanentCard({
       });
     } else if (isValidTarget) {
       dispatchAction({ type: "ChooseTarget", data: { target: { Object: objectId } } });
-    } else if (attachmentsActionable) {
-      // The host is not a legal choice, but one of its attachments is. Open
-      // the full-card chooser rather than requiring a precise click on an
-      // overlapping attachment peek. The fan derives every selectable card
-      // from the engine's current legal-target set.
-      showAttachmentFan();
     } else if (isActivatable) {
       // THE single authority for "what does a click on this bucket do"
       // (viewmodel/cardActionChoice.ts). Owns the CR 605.1a mana/non-mana
@@ -723,6 +725,25 @@ export const PermanentCard = memo(function PermanentCard({
       }
     } else if (isUndoableTap) {
       dispatchAction({ type: "UntapLandForMana", data: { object_id: objectId } });
+    } else if (attachmentsActionable) {
+      // The host is not a legal choice, but one of its attachments is. Open
+      // the full-card chooser rather than requiring a precise click on an
+      // overlapping attachment peek. The fan derives every selectable card
+      // from the engine's current legal-target set.
+      //
+      // Placed after the host's own target / activation / undo intent for the
+      // same reason the affordance-set branch below is placed last: the premise
+      // "the host is not a legal choice" is not something this branch can see.
+      // During Priority `HumanResponseModel::ExactCandidates` publishes a fan for
+      // EVERY activatable attachment, so the fan's existence says nothing about
+      // the host — and while this sat above `isActivatable`, a creature with its
+      // own ability was unreachable whenever an Aura or Equipment on it was also
+      // activatable. The fan cannot stand in for the host either: it excludes the
+      // host by design (`AttachmentFan.tsx`, `id !== host.id`), so the host's
+      // ability had no path at all. Reported for Slumbering Keepguard under
+      // Cooped Up, whose `{2}{W}` is legitimately activatable from the
+      // battlefield — no engine defect required.
+      showAttachmentFan();
     } else if (
       obj.attachments.some(
         (attachId) => activatableObjectIds.has(attachId) || manaTappableObjectIds.has(attachId),
@@ -1106,7 +1127,39 @@ export const PermanentCard = memo(function PermanentCard({
         />
       )}
 
-      {obj.attachments.length === 1 && (
+      {/* The explicit route into the fan, and the ONLY one once the host's own
+          click belongs to the host (see the `attachmentsActionable` branch). The
+          `+N` control above covers the collapsed case and this covers the
+          expanded one — `attachmentsExpanded` is the same predicate `+N` is
+          derived from, so the two are complementary by construction and exactly
+          one entry point renders in every state.
+          Was `length === 1`, which left a host with SEVERAL expanded attachments
+          with no entry point at all — the state Priority produces, because
+          `attachmentsActionable` is itself one of the disjuncts that expands the
+          stack, and each attachment is then reachable only through a ~22px peek
+          rendered behind the host face.
+          Two states the gate deliberately leaves without a control, so the
+          "complementary" claim above is not unconditional: with no attachments
+          neither renders and none is needed, and on a NESTED host the button is
+          painted inside the peek wrapper's `zIndex: 5 - i` and so sits under the
+          parent's card face, focus ring included — the working fallback there is
+          that host's OWN peek, which opens a fan keyed to it, and since a fan
+          lists a host plus its direct children that is one hop per level and
+          therefore enough.
+          The size is left exactly as it was, deliberately. This control is now
+          the pointer route where the host's own click used to open the fan, and
+          at `clamp(20px, …, 28px)` it is under the 44px floor the branch above
+          cites — but 44px is not reachable here. Battlefield cards sit in an
+          8px gap (`BattlefieldRow.tsx:176`, `const gap = 8`) and `--card-base`
+          floors at 3.5rem, so at `-left-2.5` the badge already overhangs the
+          gap; growing outward to 44px would put ~26px over the NEIGHBOUR's face
+          at `z-40` and steal its clicks, and growing inward would swallow most
+          of a 56px card — either way re-creating, in miniature, the click theft
+          this branch exists to undo. A sub-44px target that takes only its own
+          corner is the better trade; the floor needs a layout-level answer
+          (badge sizes are shared with `+N` and the group-expand control at
+          `GroupedPermanent.tsx:279`, which caps its own overhang at 12px). */}
+      {obj.attachments.length > 0 && attachmentsExpanded && (
         <button
           type="button"
           className="absolute -left-2.5 -top-2.5 z-40 flex items-center justify-center rounded-full bg-black/90 leading-none text-amber-200 ring-2 ring-amber-200/80 shadow-[0_2px_8px_rgba(0,0,0,0.65)] transition-transform hover:scale-105 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-white"
@@ -1115,8 +1168,8 @@ export const PermanentCard = memo(function PermanentCard({
             height: attachmentBadgeSize,
             fontSize: attachmentBadgeFontSize,
           }}
-          title={t("permanent.viewAttachmentsFor", { count: 1, name: obj.name })}
-          aria-label={t("permanent.viewAttachmentsFor", { count: 1, name: obj.name })}
+          title={t("permanent.viewAttachmentsFor", { count: attachmentFanCardCount, name: obj.name })}
+          aria-label={t("permanent.viewAttachmentsFor", { count: attachmentFanCardCount, name: obj.name })}
           onPointerDown={(event) => event.stopPropagation()}
           onClick={openAttachmentFan}
         >
diff --git a/client/src/components/board/__tests__/PermanentCard.test.tsx b/client/src/components/board/__tests__/PermanentCard.test.tsx
index 036c82167e..58b59c5603 100644
--- a/client/src/components/board/__tests__/PermanentCard.test.tsx
+++ b/client/src/components/board/__tests__/PermanentCard.test.tsx
@@ -189,6 +189,48 @@ function interactionForAttachedObject(objectId: number): ViewerInteraction {
   return interactionForAttachedObjects([objectId]);
 }
 
+/**
+ * The reported board: Slumbering Keepguard (`{2}{W}`: pump) enchanted by Cooped
+ * Up (`{2}{W}`: Exile enchanted creature). Cooped Up is deliberate — its
+ * ability is legitimately activatable FROM THE BATTLEFIELD, so the Aura being a
+ * live choice is CORRECT and the host's unreachability needs no engine defect
+ * to reproduce.
+ */
+function keepguardUnderCoopedUp(): GameState {
+  const keepguard = makeObject({
+    id: 1,
+    name: "Slumbering Keepguard",
+    attachments: [2],
+    power: 3,
+    toughness: 3,
+    base_power: 3,
+    base_toughness: 3,
+  });
+  const coopedUp = makeObject({
+    id: 2,
+    card_id: 200,
+    attached_to: { type: "Object", data: 1 },
+    attachments: [],
+    name: "Cooped Up",
+    power: null,
+    toughness: null,
+    base_power: null,
+    base_toughness: null,
+    card_types: { supertypes: [], core_types: ["Enchantment"], subtypes: ["Aura"] },
+    color: ["White"],
+    base_color: ["White"],
+  });
+
+  return buildGameState({
+    players: buildPlayers([0, 1]),
+    objects: buildObjectMap(keepguard, coopedUp),
+    battlefield: [1, 2],
+    exile: [],
+    stack: [],
+    waiting_for: buildPriorityWaitingFor(),
+  });
+}
+
 describe("PermanentCard", () => {
   beforeEach(() => {
     window.matchMedia = ((query: string) => ({
@@ -208,6 +250,10 @@ describe("PermanentCard", () => {
       legalActions: [],
       legalActionsByObject: {},
       spellCosts: {},
+      // Reset alongside the rest of the engine-published state: without this the
+      // rows that publish an attachment fan leak it into every later row, so the
+      // suite only passed because they happened to be declared last.
+      viewerInteraction: null,
     });
     useUiStore.setState({
       selectedObjectId: null,
@@ -823,6 +869,196 @@ describe("PermanentCard", () => {
     expect(useUiStore.getState().attachmentFanHostId).toBeNull();
   });
 
+  /**
+   * Reported from a real game (Priority during Declare Blockers): Slumbering
+   * Keepguard's `{2}{W}` was unreachable while Cooped Up sat on it. Every click
+   * on the host — centre, edge, corner — opened the attachment chooser, and the
+   * chooser cannot pick the host by design (`AttachmentFan.tsx:241`,
+   * `id !== host.id`), so the host's own ability had no path at all.
+   *
+   * This is the SAME branch-order invariant the V13 arm above pins, on the OTHER
+   * source. Hunk B reads the affordance sets and sits LAST; the
+   * `attachmentsActionable` branch reads `viewerInteraction.attachmentFans` and
+   * USED TO sit above the activation branch, on the premise stated in its own
+   * comment — "the host is not a legal choice" — which is unchecked and false
+   * whenever Priority publishes the host as activatable too. It now sits below
+   * the host's own intent (`PermanentCard.tsx:694` activation, `:727` the fan
+   * branch, `:747` hunk B), which is what this row pins.
+   *
+   * COVERAGE GAP this closed: before this row, every interaction-fan test in
+   * this file called `renderPermanent()` with no arguments, so
+   * `activatableObjectIds` was empty in all of them and no arm held a fan AND an
+   * activatable host at once — which is precisely what
+   * `HumanResponseModel::ExactCandidates` publishes during Priority.
+   */
+  const keepguardPump = {
+    type: "ActivateAbility",
+    data: { source_id: 1, ability_index: 0 },
+  } as const;
+  const coopedUpExile = {
+    type: "ActivateAbility",
+    data: { source_id: 2, ability_index: 0 },
+  } as const;
+
+  it("activates the host's own ability while an attachment is a live interaction choice", () => {
+    const gameState = keepguardUnderCoopedUp();
+    useGameStore.setState({
+      gameState,
+      waitingFor: gameState.waiting_for,
+      viewerInteraction: interactionForAttachedObject(2),
+      legalActionsByObject: { "1": [keepguardPump], "2": [coopedUpExile] },
+    });
+    act(() => {
+      useUiStore.setState({ attachmentFanHostId: null, selectedObjectId: null });
+    });
+
+    const { container } = renderPermanent(new Set(), new Set(), new Set(), new Set([1, 2]));
+    clickHost(container);
+
+    expect(dispatchAction).toHaveBeenCalledWith(keepguardPump);
+    expect(useUiStore.getState().attachmentFanHostId).toBeNull();
+    // BRANCH DISCRIMINATOR: hunk B (`:747`) selects the host unconditionally, so
+    // a failure caused by THAT branch would leave `selectedObjectId === 1`.
+    // MEASURED on the DROP side (the fan branch restored above activation):
+    //   `dispatched: [] fanHostId: 1 selectedObjectId: null`
+    // — no selection, which only the `:727` branch produces, so the red state is
+    // attributable to it and not to hunk B. It also matches the reported
+    // screenshot: the host rendered dimmed and WITHOUT a selection ring. Left as
+    // evidence rather than an assertion: a fix must reach the ability, and
+    // whether it also selects the host is not this row's business.
+  });
+
+  // REACHABILITY GUARD for the reorder above. Handing the click back to the host
+  // is only correct if the attachments keep a route of their own. Two attachments
+  // that are both actionable auto-expand the stack, so `hiddenAttachmentCount`
+  // is 0 and the `+N` control is absent; the `⧉` control used to require exactly
+  // ONE attachment, leaving this state with no entry point at all and each Aura
+  // reachable only through a ~22px peek behind the host face.
+  //
+  // The reported board was Slumbering Keepguard under TWO Bestial Bloodline, but
+  // the fixture deliberately uses Cage of Hands (`{1}{W}: Return this Aura to its
+  // owner's hand`) as the second Aura: Bestial Bloodline's only activated ability
+  // works from the graveyard, so its appearing as a live choice on the
+  // battlefield is a separate engine defect (CR 113.6b). Pinning this row on two
+  // Auras that are legitimately activatable keeps it green once that is fixed.
+  it("keeps an explicit fan route on a host whose several attachments are all expanded", () => {
+    const gameState = keepguardUnderCoopedUp();
+    const secondAura = buildGameObject({
+      ...gameState.objects[2],
+      id: 3,
+      card_id: 300,
+      name: "Cage of Hands",
+    });
+    gameState.objects[1] = { ...gameState.objects[1], attachments: [2, 3] };
+    gameState.objects[3] = secondAura;
+    gameState.battlefield = [1, 2, 3];
+    useGameStore.setState({
+      gameState,
+      waitingFor: gameState.waiting_for,
+      viewerInteraction: interactionForAttachedObjects([2, 3]),
+      legalActionsByObject: { "1": [keepguardPump], "2": [coopedUpExile] },
+    });
+    act(() => {
+      useUiStore.setState({ attachmentFanHostId: null, selectedObjectId: null });
+    });
+
+    const { container } = renderPermanent(new Set(), new Set(), new Set(), new Set([1, 2, 3]));
+
+    // Both attachments are on the board, so nothing is hidden and no `+N` exists.
+    expect(container.querySelector('[data-object-id="2"]')).not.toBeNull();
+    expect(container.querySelector('[data-object-id="3"]')).not.toBeNull();
+
+    // Stated as its own claim so the red state reads "no explicit route exists"
+    // rather than as a selector that stopped matching.
+    // MEASURED (drop side — the control gated back on `attachments.length === 1`):
+    //   `Unable to find a label with the text of: /Slumbering Keepguard/`.
+    const fanControl = screen.queryByLabelText(/Slumbering Keepguard/, { selector: "button" });
+    expect(fanControl).not.toBeNull();
+
+    fireEvent.click(fanControl as HTMLElement);
+    expect(useUiStore.getState().attachmentFanHostId).toBe(1);
+  });
+
+  // The pair, and the guard on the reorder: when the host itself offers nothing
+  // the fan MUST still take the click, because the Aura's ability is only
+  // reachable through it.
+  //
+  // `selectedObjectId` is what makes this arm discriminating, and it is not
+  // decoration. `attachmentFanHostId === 1` alone is NOT enough: the
+  // affordance-set branch below (hunk B) produces the very same fan from the
+  // very same fixture, so deleting the branch under test left this row green.
+  // Only hunk B calls `selectObject`, so requiring NO selection is what proves
+  // the fan came from the interaction branch.
+  // MEASURED (drop side — the `attachmentsActionable` branch deleted):
+  //   `expected 1 to be null` on the selection assertion; hunk B answered the
+  //   click instead. Before that assertion existed the mutant was invisible here.
+  it("still opens the fan when only the attachment is a live interaction choice", () => {
+    const gameState = keepguardUnderCoopedUp();
+    useGameStore.setState({
+      gameState,
+      waitingFor: gameState.waiting_for,
+      viewerInteraction: interactionForAttachedObject(2),
+      legalActionsByObject: { "2": [coopedUpExile] },
+    });
+    act(() => {
+      useUiStore.setState({ attachmentFanHostId: null, selectedObjectId: null });
+    });
+
+    const { container } = renderPermanent(new Set(), new Set(), new Set(), new Set([2]));
+    clickHost(container);
+
+    expect(useUiStore.getState().attachmentFanHostId).toBe(1);
+    expect(dispatchAction).not.toHaveBeenCalled();
+    expect(useUiStore.getState().selectedObjectId).toBeNull();
+  });
+
+  // The two halves of the `⧉` gate, each pinned on its own. Without these the
+  // gate could be weakened to either disjunct alone and the whole board suite
+  // stayed green: dropping `attachmentsExpanded` puts a `⧉` on every permanent
+  // that has attachments including collapsed ones (two competing controls), and
+  // dropping `obj.attachments.length > 0` puts one on every permanent on the
+  // board, attachments or not.
+  it("hands the collapsed state to the +N control and renders no second route", () => {
+    const gameState = keepguardUnderCoopedUp();
+    const secondAura = buildGameObject({
+      ...gameState.objects[2],
+      id: 3,
+      card_id: 300,
+      name: "Cage of Hands",
+    });
+    gameState.objects[1] = { ...gameState.objects[1], attachments: [2, 3] };
+    gameState.objects[3] = secondAura;
+    gameState.battlefield = [1, 2, 3];
+    // No interaction fan and no selection, so nothing expands the stack.
+    useGameStore.setState({ gameState, waitingFor: gameState.waiting_for });
+    act(() => {
+      useUiStore.setState({ attachmentFanHostId: null, selectedObjectId: null });
+    });
+
+    renderPermanent();
+
+    expect(screen.queryByLabelText(/Slumbering Keepguard/, { selector: "button" })).toBeNull();
+    // Reach guard: proves the fixture really is collapsed rather than simply
+    // missing both controls for some unrelated reason.
+    expect(screen.getByText("+1")).toBeInTheDocument();
+  });
+
+  it("renders no fan route on a permanent that has no attachments", () => {
+    const gameState = keepguardUnderCoopedUp();
+    gameState.objects[1] = { ...gameState.objects[1], attachments: [] };
+    gameState.battlefield = [1];
+    useGameStore.setState({ gameState, waitingFor: gameState.waiting_for });
+
+    const { container } = renderPermanent();
+
+    expect(screen.queryByLabelText(/Slumbering Keepguard/, { selector: "button" })).toBeNull();
+    expect(screen.queryByText(/^\+\d+$/)).toBeNull();
+    // Reach guard, matching the row above: both assertions are negative, so
+    // without this an early return (`PermanentCard.tsx:491`, `if (!obj)`) or any
+    // fixture drift would satisfy them for the wrong reason.
+    expect(container.querySelector('[data-object-id="1"]')).not.toBeNull();
+  });
+
   it("refreshes the attachment fan when the engine clears host attachments", () => {
     const gameState = makeState();
     const host = gameState.objects[1];
diff --git a/client/src/i18n/locales/de/game.json b/client/src/i18n/locales/de/game.json
index 9bdb47a100..702d4c847b 100644
--- a/client/src/i18n/locales/de/game.json
+++ b/client/src/i18n/locales/de/game.json
@@ -260,12 +260,16 @@
     "ringBearer": "Ring",
     "ringBearerTooltip": "Ringträger",
     "hiddenAttachments": "+{{count}} more attached",
+    "hiddenAttachmentsAria_few": "{{count}} verborgene angelegte Karten anzeigen",
+    "hiddenAttachmentsAria_many": "{{count}} verborgene angelegte Karten anzeigen",
     "hiddenAttachmentsAria_one": "{{count}} verborgene angelegte Karte anzeigen",
     "hiddenAttachmentsAria_other": "{{count}} verborgene angelegte Karten anzeigen",
     "fanPick": "Wählen",
     "fanConfirm": "Bestätigen ({{count}})",
     "viewAttachments_one": "Angelegte Karte ansehen",
     "viewAttachments_other": "{{count}} angelegte Karten ansehen",
+    "viewAttachmentsFor_few": "{{count}} angelegte Karten von {{name}} ansehen",
+    "viewAttachmentsFor_many": "{{count}} angelegte Karten von {{name}} ansehen",
     "viewAttachmentsFor_one": "Angelegte Karte von {{name}} ansehen",
     "viewAttachmentsFor_other": "{{count}} angelegte Karten von {{name}} ansehen",
     "hiddenExileCards": "+{{count}} more exiled",
diff --git a/client/src/i18n/locales/en/game.json b/client/src/i18n/locales/en/game.json
index d3285c72ac..9d9a7e3465 100644
--- a/client/src/i18n/locales/en/game.json
+++ b/client/src/i18n/locales/en/game.json
@@ -267,12 +267,16 @@
     "ringBearer": "Ring",
     "ringBearerTooltip": "Ring-bearer",
     "hiddenAttachments": "+{{count}} more attached",
+    "hiddenAttachmentsAria_few": "Show {{count}} hidden attached cards",
+    "hiddenAttachmentsAria_many": "Show {{count}} hidden attached cards",
     "hiddenAttachmentsAria_one": "Show {{count}} hidden attached card",
     "hiddenAttachmentsAria_other": "Show {{count}} hidden attached cards",
     "fanPick": "Pick",
     "fanConfirm": "Confirm ({{count}})",
     "viewAttachments_one": "View attached card",
     "viewAttachments_other": "View {{count}} attached cards",
+    "viewAttachmentsFor_few": "View {{name}}'s {{count}} attached cards",
+    "viewAttachmentsFor_many": "View {{name}}'s {{count}} attached cards",
     "viewAttachmentsFor_one": "View {{name}}'s attached card",
     "viewAttachmentsFor_other": "View {{name}}'s {{count}} attached cards",
     "hiddenExileCards": "+{{count}} more exiled",
diff --git a/client/src/i18n/locales/es/game.json b/client/src/i18n/locales/es/game.json
index 67ede2a701..ee216ea24e 100644
--- a/client/src/i18n/locales/es/game.json
+++ b/client/src/i18n/locales/es/game.json
@@ -260,12 +260,16 @@
     "ringBearer": "Anillo",
     "ringBearerTooltip": "Portador del Anillo",
     "hiddenAttachments": "+{{count}} more attached",
+    "hiddenAttachmentsAria_few": "Mostrar {{count}} cartas anexas ocultas",
+    "hiddenAttachmentsAria_many": "Mostrar {{count}} cartas anexas ocultas",
     "hiddenAttachmentsAria_one": "Mostrar {{count}} carta anexa oculta",
     "hiddenAttachmentsAria_other": "Mostrar {{count}} cartas anexas ocultas",
     "fanPick": "Elegir",
     "fanConfirm": "Confirmar ({{count}})",
     "viewAttachments_one": "Ver carta anexada",
     "viewAttachments_other": "Ver {{count}} cartas anexadas",
+    "viewAttachmentsFor_few": "Ver {{count}} cartas anexadas de {{name}}",
+    "viewAttachmentsFor_many": "Ver {{count}} cartas anexadas de {{name}}",
     "viewAttachmentsFor_one": "Ver carta anexada de {{name}}",
     "viewAttachmentsFor_other": "Ver {{count}} cartas anexadas de {{name}}",
     "hiddenExileCards": "+{{count}} more exiled",
diff --git a/client/src/i18n/locales/fr/game.json b/client/src/i18n/locales/fr/game.json
index e0bbb54da9..62a2304b79 100644
--- a/client/src/i18n/locales/fr/game.json
+++ b/client/src/i18n/locales/fr/game.json
@@ -260,12 +260,16 @@
     "ringBearer": "Anneau",
     "ringBearerTooltip": "Porteur de l'Anneau",
     "hiddenAttachments": "+{{count}} more attached",
+    "hiddenAttachmentsAria_few": "Afficher {{count}} cartes attachées masquées",
+    "hiddenAttachmentsAria_many": "Afficher {{count}} cartes attachées masquées",
     "hiddenAttachmentsAria_one": "Afficher {{count}} carte attachée masquée",
     "hiddenAttachmentsAria_other": "Afficher {{count}} cartes attachées masquées",
     "fanPick": "Choisir",
     "fanConfirm": "Confirmer ({{count}})",
     "viewAttachments_one": "Voir la carte attachée",
     "viewAttachments_other": "Voir {{count}} cartes attachées",
+    "viewAttachmentsFor_few": "Voir les {{count}} cartes attachées de {{name}}",
+    "viewAttachmentsFor_many": "Voir les {{count}} cartes attachées de {{name}}",
     "viewAttachmentsFor_one": "Voir la carte attachée de {{name}}",
     "viewAttachmentsFor_other": "Voir les {{count}} cartes attachées de {{name}}",
     "hiddenExileCards": "+{{count}} more exiled",
diff --git a/client/src/i18n/locales/it/game.json b/client/src/i18n/locales/it/game.json
index 0b0f514cbd..a97b671014 100644
--- a/client/src/i18n/locales/it/game.json
+++ b/client/src/i18n/locales/it/game.json
@@ -260,12 +260,16 @@
     "ringBearer": "Anello",
     "ringBearerTooltip": "Portatore dell'Anello",
     "hiddenAttachments": "+{{count}} more attached",
+    "hiddenAttachmentsAria_few": "Mostra {{count}} carte assegnate nascoste",
+    "hiddenAttachmentsAria_many": "Mostra {{count}} carte assegnate nascoste",
     "hiddenAttachmentsAria_one": "Mostra {{count}} carta assegnata nascosta",
     "hiddenAttachmentsAria_other": "Mostra {{count}} carte assegnate nascoste",
     "fanPick": "Scegli",
     "fanConfirm": "Conferma ({{count}})",
     "viewAttachments_one": "Mostra carta assegnata",
     "viewAttachments_other": "Mostra {{count}} carte assegnate",
+    "viewAttachmentsFor_few": "Mostra {{count}} carte assegnate a {{name}}",
+    "viewAttachmentsFor_many": "Mostra {{count}} carte assegnate a {{name}}",
     "viewAttachmentsFor_one": "Mostra carta assegnata a {{name}}",
     "viewAttachmentsFor_other": "Mostra {{count}} carte assegnate a {{name}}",
     "hiddenExileCards": "+{{count}} more exiled",
diff --git a/client/src/i18n/locales/pl/game.json b/client/src/i18n/locales/pl/game.json
index 4f1cedd660..72cd30d1bf 100644
--- a/client/src/i18n/locales/pl/game.json
+++ b/client/src/i18n/locales/pl/game.json
@@ -260,14 +260,18 @@
     "ringBearer": "Pierścień",
     "ringBearerTooltip": "Powiernik Pierścienia",
     "hiddenAttachments": "+{{count}} more attached",
+    "hiddenAttachmentsAria_few": "Pokaż {{count}} ukryte dołączone karty",
+    "hiddenAttachmentsAria_many": "Pokaż {{count}} ukrytych dołączonych kart",
     "hiddenAttachmentsAria_one": "Pokaż {{count}} ukrytą dołączoną kartę",
-    "hiddenAttachmentsAria_other": "Pokaż {{count}} ukryte dołączone karty",
+    "hiddenAttachmentsAria_other": "Pokaż {{count}} ukrytych dołączonych kart",
     "fanPick": "Wybierz",
     "fanConfirm": "Potwierdź ({{count}})",
     "viewAttachments_one": "Pokaż dołączoną kartę",
     "viewAttachments_other": "Pokaż dołączone karty ({{count}})",
+    "viewAttachmentsFor_few": "Pokaż {{count}} dołączone karty {{name}}",
+    "viewAttachmentsFor_many": "Pokaż {{count}} dołączonych kart {{name}}",
     "viewAttachmentsFor_one": "Pokaż dołączoną kartę {{name}}",
-    "viewAttachmentsFor_other": "Pokaż {{count}} dołączone karty {{name}}",
+    "viewAttachmentsFor_other": "Pokaż {{count}} dołączonych kart {{name}}",
     "hiddenExileCards": "+{{count}} more exiled",
     "sacrifice": "Sacrifice",
     "boardChoiceBadges": {
diff --git a/client/src/i18n/locales/pt/game.json b/client/src/i18n/locales/pt/game.json
index 4e347985e6..91acbfb55f 100644
--- a/client/src/i18n/locales/pt/game.json
+++ b/client/src/i18n/locales/pt/game.json
@@ -260,12 +260,16 @@
     "ringBearer": "Anel",
     "ringBearerTooltip": "Portador do Anel",
     "hiddenAttachments": "+{{count}} more attached",
+    "hiddenAttachmentsAria_few": "Mostrar {{count}} cartas anexadas ocultas",
+    "hiddenAttachmentsAria_many": "Mostrar {{count}} cartas anexadas ocultas",
     "hiddenAttachmentsAria_one": "Mostrar {{count}} carta anexada oculta",
     "hiddenAttachmentsAria_other": "Mostrar {{count}} cartas anexadas ocultas",
     "fanPick": "Escolher",
     "fanConfirm": "Confirmar ({{count}})",
     "viewAttachments_one": "Ver carta anexada",
     "viewAttachments_other": "Ver {{count}} cartas anexadas",
+    "viewAttachmentsFor_few": "Ver {{count}} cartas anexadas a {{name}}",
+    "viewAttachmentsFor_many": "Ver {{count}} cartas anexadas a {{name}}",
     "viewAttachmentsFor_one": "Ver carta anexada a {{name}}",
     "viewAttachmentsFor_other": "Ver {{count}} cartas anexadas a {{name}}",
     "hiddenExileCards": "+{{count}} more exiled",

From bf8a199fa14431416ae83ead225e7e175b6696e6 Mon Sep 17 00:00:00 2001
From: cuinhellcat <217210902+cuinhellcat@users.noreply.github.com>
Date: Fri, 14 Aug 2026 13:34:45 +0200
Subject: [PATCH 2/8] fix(engine): publish attachment-fan membership from the
 interaction projection
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The fan's membership was decided in `client/src`: it walked `GameObject
.attachments`, merged `viewerInteraction.attachmentFans` from every descendant
and produced the list it rendered. That is a second interaction authority, and
it read an offer list as an inventory list — `attachment_fans_for_object_choices`
publishes per DIRECT host and only for a child with exactly one legal choice, so
one attachment's Equip erased its siblings from the only surface that shows
attached cards at all.

`ViewerInteraction` now carries `attachment_views`: for every object the viewer
can see, the whole attachment subtree in depth-first order, each card holding the
engine's opaque submission when one was published for it — under any host in that
subtree, nested fans included — and `None` otherwise. Both directions of every
relationship must agree, the same guard the fans already applied, so stale or
authority-only back-links cannot reach a consumer.

It is a second field rather than a widening of `attachment_fans` because the two
answer different questions. A fan is what this viewer may submit right now, so it
is authorization-scoped and empty for everyone else — the existing contract pins
that. Membership is a board fact (CR 301.5 / CR 303.4: an attached permanent is
its own object on the battlefield), so it follows visibility instead and is
published on every projection, including an opponent's turn, an open prompt and a
terminal game. Folding one into the other would either delete that contract
assertion or make attachments vanish from the display whenever the viewer cannot
act.

The client renders and counts the projection and nothing else: `AttachmentFan`
maps `cards` and gates each pick on that card's submission (else the shared
`deriveActivationAffordances` authority the battlefield ring uses), and the badge
label counts the same list, so label and fan can no longer disagree. A published
pick is offered only while `canSubmit`, which the click path already required.

Engine contract rows: the nested route submits through production dispatch from
the outer host's view, membership survives an unauthorized viewer while the fan
does not, a stale link in either direction publishes nothing, and the projection
crosses the adapter round trip with `submission: null` intact and a missing field
still loading. Counter-measured: direct children only -> `left: [2, 4] right:
[2, 3, 4]`; dropping the back-link check -> the stale-link row; published-only
membership in the client -> 11 red rows; dropping `canSubmit` -> 1.

Wire protocol 21 -> 22: the field parses on a v21 peer as an empty map, so the
loss is silent and the handshake is the only place the pairing can be refused.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../__tests__/server-draft-adapter.test.ts    |   1 +
 .../adapter/generated/interaction/index.ts    |  11 +-
 client/src/components/board/AttachmentFan.tsx |  71 +++---
 client/src/components/board/PermanentCard.tsx |  38 ++--
 .../board/__tests__/AttachmentFan.test.tsx    | 112 +++++++--
 .../board/__tests__/PermanentCard.test.tsx    |  71 ++++--
 .../abilityChoiceConsumerWiring.test.tsx      |  17 +-
 .../__tests__/LoopShortcutModal.test.tsx      |   1 +
 client/src/network/__tests__/protocol.test.ts |  18 +-
 client/src/network/protocol.ts                |   6 +-
 .../GamePage.projectedManaChoices.test.ts     |   1 +
 crates/engine/src/bin/interaction_bindings.rs |  31 +--
 crates/engine/src/game/interaction.rs         | 143 +++++++++++-
 crates/engine/src/types/interaction.rs        |  49 ++++
 .../tests/integration/interaction_contract.rs | 215 ++++++++++++++++++
 15 files changed, 670 insertions(+), 115 deletions(-)

diff --git a/client/src/adapter/__tests__/server-draft-adapter.test.ts b/client/src/adapter/__tests__/server-draft-adapter.test.ts
index ccad40aa25..e0a867ccce 100644
--- a/client/src/adapter/__tests__/server-draft-adapter.test.ts
+++ b/client/src/adapter/__tests__/server-draft-adapter.test.ts
@@ -115,6 +115,7 @@ const viewerInteraction = {
   autoPassRecommended: false,
   opportunities: [],
   attachmentFans: {},
+  attachmentViews: {},
   availability: { type: "inputRequired" },
 } as LegalActionsResult["viewerInteraction"];
 
diff --git a/client/src/adapter/generated/interaction/index.ts b/client/src/adapter/generated/interaction/index.ts
index 9a2a393660..63464cbb66 100644
--- a/client/src/adapter/generated/interaction/index.ts
+++ b/client/src/adapter/generated/interaction/index.ts
@@ -111,9 +111,18 @@ export type InteractionAttachmentFanChild = { objectId: number, submission: Inte
 
 export type InteractionAttachmentFan = { hostId: number, children: Array<InteractionAttachmentFanChild>, };
 
+export type InteractionAttachmentViewCard = { objectId: number, submission: InteractionSubmission | null, };
+
+export type InteractionAttachmentView = { hostId: number, cards: Array<InteractionAttachmentViewCard>, };
+
 export type InteractionAvailability = { "type": "progressAvailable", "data": { witness: InteractionSubmission, } } | { "type": "inputRequired" } | { "type": "escapeOnly", "data": { reason: InteractionReasonCode, } } | { "type": "waiting" } | { "type": "terminal", "data": { outcome: InteractionOutcomeCode, } } | { "type": "unsupported", "data": { reason: InteractionReasonCode, } } | { "type": "stuck", "data": { reason: InteractionReasonCode, } };
 
-export type ViewerInteraction = { waitingForKind: InteractionWaitingForKind, authorizedSubmitters: Array<number>, canSubmit: boolean, autoPassRecommended: boolean, opportunities: Array<InteractionOpportunity>, attachmentFans: Record<number, InteractionAttachmentFan>, availability: InteractionAvailability, };
+export type ViewerInteraction = { waitingForKind: InteractionWaitingForKind, authorizedSubmitters: Array<number>, canSubmit: boolean, autoPassRecommended: boolean, opportunities: Array<InteractionOpportunity>, attachmentFans: Record<number, InteractionAttachmentFan>, 
+/**
+ * What is attached to each visible object, keyed by that object. Published
+ * on every projection, including the ones that carry no opportunity at all.
+ */
+attachmentViews: Record<number, InteractionAttachmentView>, availability: InteractionAvailability, };
 
 export type AmountAssignment = { choiceId: InteractionChoiceId, amount: number, };
 
diff --git a/client/src/components/board/AttachmentFan.tsx b/client/src/components/board/AttachmentFan.tsx
index 12829ed0b0..53459f2dd1 100644
--- a/client/src/components/board/AttachmentFan.tsx
+++ b/client/src/components/board/AttachmentFan.tsx
@@ -3,6 +3,7 @@ import { createPortal } from "react-dom";
 import { motion } from "framer-motion";
 import { useTranslation } from "react-i18next";
 
+import type { InteractionSubmission } from "../../adapter/generated/interaction/index.ts";
 import type { ObjectId } from "../../adapter/types.ts";
 import { dispatchAction, dispatchInteraction } from "../../game/dispatch.ts";
 import { useCanActForWaitingState } from "../../hooks/usePlayerId.ts";
@@ -59,11 +60,17 @@ function fanCardSizingStyle(cardCount: number): CSSProperties {
  * independent object), and the fan lets the player choose which one without
  * hunting the peek.
  *
- * The fan NEVER invents a choice. It has exactly two engine-owned sources: an
- * open interaction's projection (mode 1), and — when no prompt is open — the
- * permanent's own legal-action bucket read through `deriveActivationAffordances`
- * (mode 2, the same authority the battlefield ring uses). Each card lights up
- * (cyan) and dispatches only what one of those two offers for that object. Terminal
+ * Membership is not this component's decision. `viewerInteraction.attachmentViews`
+ * publishes what is attached to the host, ordered and both-direction validated by
+ * the engine; the fan renders that list and never scans `attachments` itself.
+ *
+ * The fan NEVER invents a choice either. It has exactly two engine-owned sources
+ * per card: the submission the projection published for that card (mode 1), and
+ * — for a card it published none for — the permanent's own legal-action bucket
+ * read through `deriveActivationAffordances` (mode 2, the same authority the
+ * battlefield ring uses). Both live side by side in one fan, because a published
+ * pick for one attachment says nothing about its neighbours. Each card lights up
+ * (cyan) and dispatches only what one of those two offers for that object.
  * One-step picks close the fan. Multi-step decisions stay in their dedicated
  * engine-authored interaction surfaces instead of asking this display to build
  * a response payload.
@@ -98,25 +105,24 @@ export function AttachmentFan() {
     [affordances],
   );
   const host = hostId != null ? objects?.[hostId] : undefined;
-  const interactionFan = useMemo(
-    () =>
-      hostId == null
-        ? null
-        : (viewerInteraction?.attachmentFans[hostId] ?? null),
+  // THE membership authority: the engine publishes what is attached to this
+  // host, in its own order, with a submission on any card it published a
+  // one-step pick for. This display neither walks `attachments` nor decides who
+  // belongs in the fan — it renders the projection and counts it.
+  const attachmentView = useMemo(
+    () => (hostId == null ? null : (viewerInteraction?.attachmentViews[hostId] ?? null)),
     [hostId, viewerInteraction],
   );
+  const submissionById = useMemo(() => {
+    const table = new Map<ObjectId, InteractionSubmission>();
+    for (const card of attachmentView?.cards ?? []) {
+      if (card.submission !== null) table.set(card.objectId, card.submission);
+    }
+    return table;
+  }, [attachmentView]);
 
-  // During an interaction, the engine projection is the sole authority for
-  // which direct attachments belong in the fan. The fallback preserves the
-  // existing read-only badge outside an interaction, where no choice is being
-  // exposed and therefore no interaction capability exists to consume.
   const cardIds = host
-    ? [
-        host.id,
-        ...(interactionFan
-          ? interactionFan.children.map((child) => child.objectId)
-          : host.attachments),
-      ]
+    ? [host.id, ...(attachmentView?.cards ?? []).map((card) => card.objectId)]
     : [];
 
   const close = useCallback(() => {
@@ -148,12 +154,13 @@ export function AttachmentFan() {
 
   const handlePick = useCallback(
     (id: ObjectId) => {
-      // Mode 1 — an engine interaction owns the prompt: the projection is the sole
-      // authority and the fan only forwards its opaque submission. UNCHANGED.
-      if (interactionFan !== null) {
-        const child = interactionFan.children.find((candidate) => candidate.objectId === id);
-        if (!child || !viewerInteraction?.canSubmit) return;
-        void dispatchInteraction(child.submission).then(close).catch(notifyFailure);
+      // Mode 1 — the engine published a pick for THIS card: forward its opaque
+      // submission, nothing else. Decided per card, because the projection
+      // carries a pick for some members and none for others.
+      const submission = submissionById.get(id);
+      if (submission) {
+        if (!viewerInteraction?.canSubmit) return;
+        void dispatchInteraction(submission).then(close).catch(notifyFailure);
         return;
       }
       // Mode 2 — no prompt is open, so the fan is a reachability surface for the
@@ -199,14 +206,16 @@ export function AttachmentFan() {
       affordances,
       canActivate,
       close,
-      interactionFan,
+      submissionById,
       notifyFailure,
       setPendingAbilityChoice,
       viewerInteraction?.canSubmit,
     ],
   );
 
-  if (hostId == null || !host || cardIds.length === 0) return null;
+  // A fan of just the host is not a fan. With no published membership there is
+  // nothing to spread, and this display does not go looking for members itself.
+  if (hostId == null || !host || (attachmentView?.cards.length ?? 0) === 0) return null;
 
   // Shared compact whole-row fan — sized by the total card count so the host +
   // its attachments stay within the overlay's viewport budget.
@@ -239,7 +248,11 @@ export function AttachmentFan() {
             rotation={fan.rotation(i)}
             arcOffset={fan.arc(i)}
             zIndex={i}
-            selectable={id !== host.id && (interactionFan !== null || canActivate(id))}
+            selectable={
+              id !== host.id &&
+              ((submissionById.has(id) && viewerInteraction?.canSubmit === true) ||
+                canActivate(id))
+            }
             onPick={handlePick}
           />
         ))}
diff --git a/client/src/components/board/PermanentCard.tsx b/client/src/components/board/PermanentCard.tsx
index 66f5a115fa..764011ad1c 100644
--- a/client/src/components/board/PermanentCard.tsx
+++ b/client/src/components/board/PermanentCard.tsx
@@ -473,9 +473,11 @@ export const PermanentCard = memo(function PermanentCard({
     (s) => obj && s.gameState?.players?.find((p) => p.id === obj.controller)?.commander_color_identity,
   );
   const viewerInteraction = useGameStore((s) => s.viewerInteraction);
-  const interactionAttachmentFan = useMemo(
-    () =>
-      viewerInteraction?.attachmentFans[objectId] ?? null,
+  // The engine's own list of what is attached to this permanent, with a
+  // submission on each card it published a pick for. Same field `AttachmentFan`
+  // renders, so the badge's label can never promise a card the fan won't show.
+  const attachmentView = useMemo(
+    () => viewerInteraction?.attachmentViews[objectId] ?? null,
     [objectId, viewerInteraction],
   );
 
@@ -505,10 +507,13 @@ export const PermanentCard = memo(function PermanentCard({
 
   const ptDisplay = computePTDisplay(obj);
   const isSelected = selectedObjectId === objectId;
-  // The viewer-scoped engine projection owns both the direct-attachment
-  // relationship and whether one is actionable for this interaction. The
-  // board must not rediscover either fact from the raw snapshot.
-  const attachmentsActionable = interactionAttachmentFan !== null;
+  // The viewer-scoped engine projection owns both the attachment relationship
+  // and whether one is actionable for this interaction. The board must not
+  // rediscover either fact from the raw snapshot. "Actionable" is per card:
+  // the projection lists every attachment and marks the ones it published a
+  // pick for, so this asks whether ANY of them carries one.
+  const attachmentsActionable =
+    attachmentView?.cards.some((card) => card.submission !== null) ?? false;
   const attachmentsLifted =
     obj.attachments.length > 0
     && (attachmentsLiftedByAncestor || isInHoveredAttachmentTree);
@@ -517,14 +522,12 @@ export const PermanentCard = memo(function PermanentCard({
   const attachmentPathIds = new Set([...attachmentRenderPath, objectId]);
   const renderableAttachmentIds = visibleAttachmentIds.filter((id) => !attachmentPathIds.has(id));
   const hiddenAttachmentCount = obj.attachments.length - visibleAttachmentIds.length;
-  // What the fan will actually put on screen, for the `⧉` control's label. While
-  // an interaction is live `AttachmentFan` builds its cards from the projection's
-  // children, not from `obj.attachments`, so counting the raw snapshot here would
-  // promise more cards than the fan shows (an Aura + an Equipment where only the
-  // Equipment is a legal choice reads "2 attached cards" over a one-card fan) —
-  // and would rediscover from the snapshot exactly what the note above forbids.
-  const attachmentFanCardCount =
-    interactionAttachmentFan?.children.length ?? obj.attachments.length;
+  // What the fan will actually put on screen, for the `⧉` control's label: the
+  // very list the fan renders. Counting `obj.attachments` here would be both a
+  // second derivation and a wrong number — the projection also carries the
+  // attachments OF the attachments, which the fan shows and the peek stack
+  // cannot.
+  const attachmentFanCardCount = attachmentView?.cards.length ?? 0;
   const exileLinksExpanded = exileLinks.length <= 1 || isHovered || isSelected || isInspected;
   const visibleExileLinks = exileLinksExpanded ? exileLinks : exileLinks.slice(0, 1);
   const hiddenExileCount = exileLinks.length - visibleExileLinks.length;
@@ -1159,7 +1162,10 @@ export const PermanentCard = memo(function PermanentCard({
           corner is the better trade; the floor needs a layout-level answer
           (badge sizes are shared with `+N` and the group-expand control at
           `GroupedPermanent.tsx:279`, which caps its own overhang at 12px). */}
-      {obj.attachments.length > 0 && attachmentsExpanded && (
+      {/* Gated on the projected count, not on `obj.attachments`: the control
+          opens a fan built from the projection, so if the engine published no
+          membership there is nothing behind the badge to show. */}
+      {attachmentFanCardCount > 0 && attachmentsExpanded && (
         <button
           type="button"
           className="absolute -left-2.5 -top-2.5 z-40 flex items-center justify-center rounded-full bg-black/90 leading-none text-amber-200 ring-2 ring-amber-200/80 shadow-[0_2px_8px_rgba(0,0,0,0.65)] transition-transform hover:scale-105 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-white"
diff --git a/client/src/components/board/__tests__/AttachmentFan.test.tsx b/client/src/components/board/__tests__/AttachmentFan.test.tsx
index dd217bb919..16620010b6 100644
--- a/client/src/components/board/__tests__/AttachmentFan.test.tsx
+++ b/client/src/components/board/__tests__/AttachmentFan.test.tsx
@@ -20,7 +20,12 @@ import { AttachmentFan } from "../AttachmentFan.tsx";
 
 /**
  * `AttachmentFan` mode 2 — the fan as a reachability surface for an attached
- * permanent's OWN legal actions (plan §6.9). Rows V1–V9.
+ * permanent's OWN legal actions (plan §6.9). Rows V1–V12.
+ *
+ * Membership is NOT tested here beyond "the fan renders exactly what the engine
+ * published", because it is no longer this component's decision:
+ * `crates/engine/tests/integration/interaction_contract.rs` owns the subtree
+ * walk, its order and its both-direction validation.
  *
  * THE BUG THIS MODULE COVERS: with Kilo (401) enchanted by Freed from the Real
  * (408), the engine published `legalActionsByObject["408"] = [#0, #1]` and the
@@ -130,8 +135,9 @@ function seed(options: {
   freedAbilities?: unknown[];
   viewerInteraction?: ViewerInteraction | null;
 } = {}) {
+  const attachments = options.attachments ?? [FREED_ID];
   const gameState = makeState({
-    attachments: options.attachments,
+    attachments,
     freedAbilities: options.freedAbilities,
   });
   const waitingFor = options.waitingFor ?? gameState.waiting_for;
@@ -142,7 +148,11 @@ function seed(options: {
     waitingFor,
     legalActions: [],
     legalActionsByObject: options.legalActionsByObject ?? {},
-    viewerInteraction: options.viewerInteraction ?? null,
+    // Membership comes from the engine on every projection, prompt or not, so
+    // the default fixture publishes it with no pick attached. Passing `null`
+    // explicitly models a projection that never arrived.
+    viewerInteraction:
+      options.viewerInteraction === undefined ? projection(attachments) : options.viewerInteraction,
   });
   useUiStore.setState({ attachmentFanHostId: HOST_ID, pendingAbilityChoice: null });
   return render(<AttachmentFan />);
@@ -168,22 +178,39 @@ function isSelectable(name: string): boolean {
   return ringed;
 }
 
-function interactionOver(objectIds: number[]): ViewerInteraction {
+/**
+ * An engine-shaped projection for this fixture's host.
+ *
+ * `members` is what the engine publishes as attached — the whole subtree, in
+ * its order — and `published` the subset it ALSO published a one-step pick for.
+ * The two lists differ on purpose: the engine publishes a fan per direct host
+ * and only for a child with exactly one legal choice, so a member without a
+ * pick is the normal case, not an edge case.
+ */
+function projection(
+  members: number[],
+  options: { published?: number[]; canSubmit?: boolean } = {},
+): ViewerInteraction {
+  const published = options.published ?? [];
   const interactionId = "fan-interaction" as InteractionId;
   const choiceId = (objectId: number) => `fan-${objectId}` as InteractionChoiceId;
+  const submission = (objectId: number) => ({
+    interactionId,
+    response: { type: "choose" as const, data: { choiceId: choiceId(objectId) } },
+  });
   return {
     waitingForKind: { simultaneous: null, terminal: false, code: "choose" },
     authorizedSubmitters: [0],
-    canSubmit: true,
+    canSubmit: options.canSubmit ?? true,
     autoPassRecommended: false,
-    opportunities: [{
+    opportunities: published.length === 0 ? [] : [{
       interactionId,
       response: {
         type: "exactChoices",
         data: {
-          choices: objectIds.map((objectId) => ({
+          choices: published.map((objectId) => ({
             id: choiceId(objectId),
-            status: { type: "available" },
+            status: { type: "available" as const },
             surfaces: [],
           })),
         },
@@ -191,20 +218,23 @@ function interactionOver(objectIds: number[]): ViewerInteraction {
       surfaces: [],
       progress: { selected: 0, minimum: 1, maximum: 1, aggregate: null, confirmable: false },
     }],
-    attachmentFans: {
+    attachmentFans: published.length === 0 ? {} : {
       [HOST_ID]: {
         hostId: HOST_ID,
-        children: objectIds.map((objectId) => ({
+        children: published.map((objectId) => ({ objectId, submission: submission(objectId) })),
+      },
+    },
+    attachmentViews: {
+      [HOST_ID]: {
+        hostId: HOST_ID,
+        cards: members.map((objectId) => ({
           objectId,
-          submission: {
-            interactionId,
-            response: { type: "choose", data: { choiceId: choiceId(objectId) } },
-          },
+          submission: published.includes(objectId) ? submission(objectId) : null,
         })),
       },
     },
     availability: { type: "inputRequired" },
-  };
+  } as ViewerInteraction;
 }
 
 describe("AttachmentFan mode 2 — the permanent's own legal actions", () => {
@@ -349,7 +379,7 @@ describe("AttachmentFan mode 2 — the permanent's own legal actions", () => {
   it("still forwards the engine's own submission when an interaction owns the prompt", () => {
     seed({
       legalActionsByObject: {},
-      viewerInteraction: interactionOver([FREED_ID]),
+      viewerInteraction: projection([FREED_ID], { published: [FREED_ID] }),
     });
 
     fireEvent.click(fanCard("Freed from the Real"));
@@ -375,7 +405,7 @@ describe("AttachmentFan mode 2 — the permanent's own legal actions", () => {
   it("lets the engine interaction win when a prompt and a bucket are both live", () => {
     seed({
       legalActionsByObject: { [String(FREED_ID)]: [FREED_TAP, FREED_UNTAP] },
-      viewerInteraction: interactionOver([FREED_ID]),
+      viewerInteraction: projection([FREED_ID], { published: [FREED_ID] }),
     });
 
     fireEvent.click(fanCard("Freed from the Real"));
@@ -384,4 +414,52 @@ describe("AttachmentFan mode 2 — the permanent's own legal actions", () => {
     expect(dispatchAction).not.toHaveBeenCalled();
     expect(useUiStore.getState().pendingAbilityChoice).toBeNull();
   });
+
+  // V10 — THE SECOND USER-VISIBLE BUG. The engine published a pick for the Boots
+  // and none for the Aura; both are still attached, so both are still in the fan.
+  // The old fan read the published list as its membership list and the Aura
+  // vanished from the only surface that shows attached cards.
+  //
+  // MEASURED (drop side): rebuilding `cardIds` from the published picks only
+  //   reports `AssertionError: expected null not to be null` on the Aura's card.
+  it("lists an attachment the engine published no pick for, beside one it did", () => {
+    seed({
+      attachments: [FREED_ID, BOOTS_ID],
+      viewerInteraction: projection([FREED_ID, BOOTS_ID], { published: [BOOTS_ID] }),
+    });
+
+    expect(fanCard("Freed from the Real")).not.toBeNull();
+    expect(isSelectable("Swiftfoot Boots")).toBe(true);
+    expect(isSelectable("Freed from the Real")).toBe(false);
+
+    fireEvent.click(fanCard("Swiftfoot Boots"));
+    expect(dispatchInteraction).toHaveBeenCalledTimes(1);
+  });
+
+  // V11 — a published pick the viewer may not submit is not offered. The click
+  // path already refused it (`canSubmit`), so lighting it up promised an action
+  // that could not happen.
+  //
+  // MEASURED (always side): dropping `canSubmit` from `selectable` flips the
+  //   first assert to `AssertionError: expected true to be false`.
+  it("offers nothing while the viewer may not submit", () => {
+    seed({
+      viewerInteraction: projection([FREED_ID], { published: [FREED_ID], canSubmit: false }),
+    });
+
+    expect(isSelectable("Freed from the Real")).toBe(false);
+    fireEvent.click(fanCard("Freed from the Real"));
+    expect(dispatchInteraction).not.toHaveBeenCalled();
+  });
+
+  // V12 — no projection, no fan. The membership authority is the engine's alone:
+  // with nothing published there is nothing to show, and the display must NOT
+  // fall back to walking `attachments` itself (CLAUDE.md: the frontend is a
+  // display layer). The host is attached-to in the fixture, so a fallback would
+  // be plainly visible here.
+  it("shows no fan at all when the engine published no membership", () => {
+    seed({ attachments: [FREED_ID, BOOTS_ID], viewerInteraction: null });
+
+    expect(document.querySelector("[data-attachment-fan]")).toBeNull();
+  });
 });
diff --git a/client/src/components/board/__tests__/PermanentCard.test.tsx b/client/src/components/board/__tests__/PermanentCard.test.tsx
index 58b59c5603..977cd68402 100644
--- a/client/src/components/board/__tests__/PermanentCard.test.tsx
+++ b/client/src/components/board/__tests__/PermanentCard.test.tsx
@@ -146,9 +146,23 @@ function renderPermanent(
   );
 }
 
-function interactionForAttachedObjects(objectIds: number[]): ViewerInteraction {
+/**
+ * The engine's projection for host 1: `members` is everything it publishes as
+ * attached to that host — its whole subtree — and `objectIds` the subset it also
+ * published a one-step pick for. A member without a pick is the ordinary case:
+ * the engine publishes picks per direct host and only for a child with exactly
+ * one legal choice.
+ */
+function interactionForAttachedObjects(
+  objectIds: number[],
+  members: number[] = objectIds,
+): ViewerInteraction {
   const interactionId = "attachment-interaction" as InteractionId;
   const choiceId = (objectId: number) => `attachment-${objectId}` as InteractionChoiceId;
+  const submission = (objectId: number) => ({
+    interactionId,
+    response: { type: "choose" as const, data: { choiceId: choiceId(objectId) } },
+  });
   return {
     waitingForKind: { simultaneous: null, terminal: false, code: "choose" },
     authorizedSubmitters: [0],
@@ -171,24 +185,36 @@ function interactionForAttachedObjects(objectIds: number[]): ViewerInteraction {
     }],
     attachmentFans: {
       1: {
-      hostId: 1,
-      children: objectIds.map((objectId) => ({
-        objectId,
-        submission: {
-          interactionId,
-          response: { type: "choose", data: { choiceId: choiceId(objectId) } },
-        },
-      })),
+        hostId: 1,
+        children: objectIds.map((objectId) => ({ objectId, submission: submission(objectId) })),
+      },
+    },
+    attachmentViews: members.length === 0 ? {} : {
+      1: {
+        hostId: 1,
+        cards: members.map((objectId) => ({
+          objectId,
+          submission: objectIds.includes(objectId) ? submission(objectId) : null,
+        })),
       },
     },
     availability: { type: "inputRequired" },
-  };
+  } as ViewerInteraction;
 }
 
 function interactionForAttachedObject(objectId: number): ViewerInteraction {
   return interactionForAttachedObjects([objectId]);
 }
 
+/**
+ * A projection that publishes membership and no pick at all — what the engine
+ * sends whenever nothing about these cards is currently choosable, which is most
+ * of the time. The badge and the fan read it either way.
+ */
+function membershipOnly(members: number[]): ViewerInteraction {
+  return interactionForAttachedObjects([], members);
+}
+
 /**
  * The reported board: Slumbering Keepguard (`{2}{W}`: pump) enchanted by Cooped
  * Up (`{2}{W}`: Exile enchanted creature). Cooped Up is deliberate — its
@@ -252,8 +278,10 @@ describe("PermanentCard", () => {
       spellCosts: {},
       // Reset alongside the rest of the engine-published state: without this the
       // rows that publish an attachment fan leak it into every later row, so the
-      // suite only passed because they happened to be declared last.
-      viewerInteraction: null,
+      // suite only passed because they happened to be declared last. Membership
+      // itself is always published — object 2 hangs on the host and object 3 on
+      // object 2 — because the fan and the badge now read it from here.
+      viewerInteraction: membershipOnly([2, 3]),
     });
     useUiStore.setState({
       selectedObjectId: null,
@@ -643,7 +671,7 @@ describe("PermanentCard", () => {
     renderPermanent();
 
     const button = screen.getByRole("button", {
-      name: "View Test Creature's attached card",
+      name: "View Test Creature's 2 attached cards",
     });
 
     fireEvent.pointerDown(button);
@@ -658,7 +686,7 @@ describe("PermanentCard", () => {
     renderPermanent();
 
     const button = screen.getByRole("button", {
-      name: "View Test Creature's attached card",
+      name: "View Test Creature's 2 attached cards",
     });
 
     expect(button).toHaveStyle({
@@ -1047,7 +1075,13 @@ describe("PermanentCard", () => {
     const gameState = keepguardUnderCoopedUp();
     gameState.objects[1] = { ...gameState.objects[1], attachments: [] };
     gameState.battlefield = [1];
-    useGameStore.setState({ gameState, waitingFor: gameState.waiting_for });
+    // Nothing is attached, so the engine publishes no membership for this host —
+    // and the badge is gated on that, not on a scan of the snapshot.
+    useGameStore.setState({
+      gameState,
+      waitingFor: gameState.waiting_for,
+      viewerInteraction: membershipOnly([]),
+    });
 
     const { container } = renderPermanent();
 
@@ -1089,11 +1123,16 @@ describe("PermanentCard", () => {
       useGameStore.setState({
         gameState: nextState,
         waitingFor: nextState.waiting_for,
+        // The engine republishes membership with the state it belongs to; the
+        // fan follows that, not the raw `attachments` array.
+        viewerInteraction: membershipOnly([]),
       });
     });
 
-    expect(queryAllByLabelText("Test Creature").length).toBeGreaterThan(0);
+    // The last member left the battlefield, so the fan has nothing to spread and
+    // tears itself down rather than lingering as a lone host card over the board.
     expect(queryAllByLabelText("Test Equipment")).toHaveLength(0);
+    expect(queryAllByLabelText("Test Creature")).toHaveLength(0);
   });
 
   it("auto-expands collapsed attachments when one is a valid target", () => {
diff --git a/client/src/components/board/__tests__/abilityChoiceConsumerWiring.test.tsx b/client/src/components/board/__tests__/abilityChoiceConsumerWiring.test.tsx
index 94e9e455d3..5e8f441600 100644
--- a/client/src/components/board/__tests__/abilityChoiceConsumerWiring.test.tsx
+++ b/client/src/components/board/__tests__/abilityChoiceConsumerWiring.test.tsx
@@ -2,6 +2,7 @@ import { cleanup, fireEvent, render } from "@testing-library/react";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import type { GameAction, GameObject, GameState } from "../../../adapter/types.ts";
+import type { ViewerInteraction } from "../../../adapter/generated/interaction";
 import { dispatchAction, dispatchInteraction } from "../../../game/dispatch.ts";
 import { useGameStore } from "../../../stores/gameStore.ts";
 import { useUiStore } from "../../../stores/uiStore.ts";
@@ -140,7 +141,21 @@ function seed(legalActionsByObject: Record<string, GameAction[]>) {
     waitingFor: gameState.waiting_for,
     legalActions: [],
     legalActionsByObject,
-    viewerInteraction: null,
+    // Membership is engine-published on every projection, prompt or not, and the
+    // fan renders exactly that list — so the fixture has to carry it, with no
+    // pick attached (this row's clicks come from the legal-action buckets).
+    viewerInteraction: {
+      waitingForKind: { simultaneous: null, terminal: false, code: "choose" },
+      authorizedSubmitters: [0],
+      canSubmit: true,
+      autoPassRecommended: false,
+      opportunities: [],
+      attachmentFans: {},
+      attachmentViews: {
+        [HOST_ID]: { hostId: HOST_ID, cards: [{ objectId: FREED_ID, submission: null }] },
+      },
+      availability: { type: "inputRequired" },
+    } as unknown as ViewerInteraction,
   });
   // `enchantmentsDialogPlayer` is the OTHER input to `hasUiDialog`. Left
   // non-null it would raise the overlay on its own and the overlay assert
diff --git a/client/src/components/modal/__tests__/LoopShortcutModal.test.tsx b/client/src/components/modal/__tests__/LoopShortcutModal.test.tsx
index fb24035bdd..aefcf23329 100644
--- a/client/src/components/modal/__tests__/LoopShortcutModal.test.tsx
+++ b/client/src/components/modal/__tests__/LoopShortcutModal.test.tsx
@@ -58,6 +58,7 @@ function shortcutInteraction(
       },
     ],
     attachmentFans: {},
+  attachmentViews: {},
     availability: { type: "inputRequired" },
   };
 }
diff --git a/client/src/network/__tests__/protocol.test.ts b/client/src/network/__tests__/protocol.test.ts
index e79d01179d..6e37b10492 100644
--- a/client/src/network/__tests__/protocol.test.ts
+++ b/client/src/network/__tests__/protocol.test.ts
@@ -36,8 +36,8 @@ const viewerInteractionWithProducedMana = {
 } as never;
 
 describe("encodeWireMessage / decodeWireMessage", () => {
-  it("pins the P2P wire protocol to v21", () => {
-    expect(WIRE_PROTOCOL_VERSION).toBe(21);
+  it("pins the P2P wire protocol to v22", () => {
+    expect(WIRE_PROTOCOL_VERSION).toBe(22);
   });
 
   it("defaults shortcut actions for a legacy payload created before the additive field", () => {
@@ -234,15 +234,15 @@ describe("encodeWireMessage / decodeWireMessage", () => {
   // and nothing about the version. Both halves here stamp LITERALS — a frame
   // built from WIRE_PROTOCOL_VERSION cannot tell a bumped client from an
   // unbumped one, which is why every other handshake fixture in the suite is
-  // useless as an instrument for a bump. Revert 21 → 20 and BOTH halves red:
-  // the v20 frame stops being refused, and the v21 frame stops being admitted.
-  // The admitting half is the reach-guard: without it "refuses v20" is also
+  // useless as an instrument for a bump. Revert 22 → 21 and BOTH halves red:
+  // the v21 frame stops being refused, and the v22 frame stops being admitted.
+  // The admitting half is the reach-guard: without it "refuses v21" is also
   // satisfied by a client that refuses everything.
-  it("refuses the previous wire protocol (v20) and admits its own (v21)", () => {
-    expect(() => validateMessage(setupFrameAt(20))).toThrow(/Wire protocol mismatch/);
-    expect(validateMessage(setupFrameAt(21))).toMatchObject({
+  it("refuses the previous wire protocol (v21) and admits its own (v22)", () => {
+    expect(() => validateMessage(setupFrameAt(21))).toThrow(/Wire protocol mismatch/);
+    expect(validateMessage(setupFrameAt(22))).toMatchObject({
       type: "game_setup",
-      wireProtocolVersion: 21,
+      wireProtocolVersion: 22,
     });
   });
 
diff --git a/client/src/network/protocol.ts b/client/src/network/protocol.ts
index 2399511c68..2febc35eca 100644
--- a/client/src/network/protocol.ts
+++ b/client/src/network/protocol.ts
@@ -80,6 +80,10 @@ export function legalActionsFromWire(wire: LegalActionsWire): LegalActionsResult
  * of silently corrupting state.
  *
  * Bumps to date:
+ *  22 — LegalActionsWire.viewerInteraction carries attachmentViews: the engine's
+ *       membership list for each host's attachment fan. It parses on a v21 peer
+ *       as an empty map, so the loss is silent — a guest paired with a v21 host
+ *       would simply find every attachment fan gone.
  *  21 — LegalActionsWire.viewerInteraction carries the loop-shortcut preview,
  *       and the state snapshot carries WaitingFor::LoopShortcut.declaration.
  *       Both are optional and parse on a v20 peer; the loss is silent, so the
@@ -116,7 +120,7 @@ export function legalActionsFromWire(wire: LegalActionsWire): LegalActionsResult
  *       sub-phase on WaitingFor::MulliganDecision; the MulliganBottomCards
  *       variant was removed
  */
-export const WIRE_PROTOCOL_VERSION = 21 as const;
+export const WIRE_PROTOCOL_VERSION = 22 as const;
 
 export type P2PMessage = P2PAuthorityWire & (
   | { type: "guest_deck"; deckData: unknown; displayName?: string; reservationToken?: string }
diff --git a/client/src/pages/__tests__/GamePage.projectedManaChoices.test.ts b/client/src/pages/__tests__/GamePage.projectedManaChoices.test.ts
index 083fd60d78..309d02f034 100644
--- a/client/src/pages/__tests__/GamePage.projectedManaChoices.test.ts
+++ b/client/src/pages/__tests__/GamePage.projectedManaChoices.test.ts
@@ -66,6 +66,7 @@ function interactionWith(choices: InteractionChoice[]): ViewerInteraction {
       },
     ],
     attachmentFans: {},
+  attachmentViews: {},
     availability: { type: "inputRequired" },
   };
 }
diff --git a/crates/engine/src/bin/interaction_bindings.rs b/crates/engine/src/bin/interaction_bindings.rs
index 97f3d208c7..6344ec8557 100644
--- a/crates/engine/src/bin/interaction_bindings.rs
+++ b/crates/engine/src/bin/interaction_bindings.rs
@@ -3,20 +3,21 @@ use std::path::{Path, PathBuf};
 use engine::types::interaction::{
     ActiveInteractionSlot, AggregateComparator, AmountAssignment, ConfirmSemantics,
     InteractionActionCode, InteractionAggregateFunction, InteractionAttachmentFan,
-    InteractionAttachmentFanChild, InteractionAvailability, InteractionChoice,
-    InteractionChoiceStatus, InteractionDamageAssignmentMode, InteractionGroupConstraint,
-    InteractionIntentCode, InteractionManaAbilityActivationScope, InteractionManaColor,
-    InteractionManaComparator, InteractionManaRestriction, InteractionManaSpecialAction,
-    InteractionManaSpellCostCriterion, InteractionManaZoneSpendPolarity, InteractionObjectProperty,
-    InteractionOpportunity, InteractionOpportunityResponse, InteractionOutcomeCode,
-    InteractionPresentationSurface, InteractionPreview, InteractionPreviewRequest,
-    InteractionPreviewStatus, InteractionProgress, InteractionReasonCode, InteractionRelation,
-    InteractionRelationConstraint, InteractionRelationSourceConstraint, InteractionResponse,
-    InteractionResponseSpec, InteractionRoleCode, InteractionShortcutCountSpec,
-    InteractionShortcutDecision, InteractionShortcutPin, InteractionShortcutPoint,
-    InteractionShortcutPointKind, InteractionShortcutPreview, InteractionShortcutPreviewEntry,
-    InteractionShortcutPreviewFamily, InteractionShortcutReply, InteractionShortcutResponseCode,
-    InteractionSlotKind, InteractionSubmission, InteractionSummaryCode, InteractionWaitingForCode,
+    InteractionAttachmentFanChild, InteractionAttachmentView, InteractionAttachmentViewCard,
+    InteractionAvailability, InteractionChoice, InteractionChoiceStatus,
+    InteractionDamageAssignmentMode, InteractionGroupConstraint, InteractionIntentCode,
+    InteractionManaAbilityActivationScope, InteractionManaColor, InteractionManaComparator,
+    InteractionManaRestriction, InteractionManaSpecialAction, InteractionManaSpellCostCriterion,
+    InteractionManaZoneSpendPolarity, InteractionObjectProperty, InteractionOpportunity,
+    InteractionOpportunityResponse, InteractionOutcomeCode, InteractionPresentationSurface,
+    InteractionPreview, InteractionPreviewRequest, InteractionPreviewStatus, InteractionProgress,
+    InteractionReasonCode, InteractionRelation, InteractionRelationConstraint,
+    InteractionRelationSourceConstraint, InteractionResponse, InteractionResponseSpec,
+    InteractionRoleCode, InteractionShortcutCountSpec, InteractionShortcutDecision,
+    InteractionShortcutPin, InteractionShortcutPoint, InteractionShortcutPointKind,
+    InteractionShortcutPreview, InteractionShortcutPreviewEntry, InteractionShortcutPreviewFamily,
+    InteractionShortcutReply, InteractionShortcutResponseCode, InteractionSlotKind,
+    InteractionSubmission, InteractionSummaryCode, InteractionWaitingForCode,
     InteractionWaitingForKind, InteractionZoneCode, SelectionConstraint, SimultaneousDecisionKind,
     ViewerInteraction,
 };
@@ -104,6 +105,8 @@ fn expected_bindings() -> String {
         InteractionOpportunity,
         InteractionAttachmentFanChild,
         InteractionAttachmentFan,
+        InteractionAttachmentViewCard,
+        InteractionAttachmentView,
         InteractionAvailability,
         ViewerInteraction,
         AmountAssignment,
diff --git a/crates/engine/src/game/interaction.rs b/crates/engine/src/game/interaction.rs
index 633c15b219..535bda3743 100644
--- a/crates/engine/src/game/interaction.rs
+++ b/crates/engine/src/game/interaction.rs
@@ -37,17 +37,17 @@ use crate::types::identifiers::ObjectId;
 use crate::types::interaction::{
     ActiveInteractionSlot, AggregateComparator, AmountAssignment, ConfirmSemantics,
     InteractionActionCode, InteractionActionId, InteractionAggregateFunction,
-    InteractionAttachmentFan, InteractionAttachmentFanChild, InteractionAvailability,
-    InteractionChoice, InteractionChoiceId, InteractionChoiceStatus,
-    InteractionDamageAssignmentMode, InteractionGroupConstraint, InteractionId,
-    InteractionIntentCode, InteractionManaAbilityActivationScope, InteractionManaColor,
-    InteractionManaComparator, InteractionManaRestriction, InteractionManaSpecialAction,
-    InteractionManaSpellCostCriterion, InteractionManaZoneSpendPolarity, InteractionObjectProperty,
-    InteractionOpportunity, InteractionOpportunityResponse, InteractionOutcomeCode,
-    InteractionPresentationSurface, InteractionPreview, InteractionPreviewRequest,
-    InteractionPreviewStatus, InteractionProgress, InteractionReasonCode,
-    InteractionRelationConstraint, InteractionRelationSourceConstraint, InteractionResponse,
-    InteractionResponseSpec, InteractionRoleCode, InteractionSessionId,
+    InteractionAttachmentFan, InteractionAttachmentFanChild, InteractionAttachmentView,
+    InteractionAttachmentViewCard, InteractionAvailability, InteractionChoice, InteractionChoiceId,
+    InteractionChoiceStatus, InteractionDamageAssignmentMode, InteractionGroupConstraint,
+    InteractionId, InteractionIntentCode, InteractionManaAbilityActivationScope,
+    InteractionManaColor, InteractionManaComparator, InteractionManaRestriction,
+    InteractionManaSpecialAction, InteractionManaSpellCostCriterion,
+    InteractionManaZoneSpendPolarity, InteractionObjectProperty, InteractionOpportunity,
+    InteractionOpportunityResponse, InteractionOutcomeCode, InteractionPresentationSurface,
+    InteractionPreview, InteractionPreviewRequest, InteractionPreviewStatus, InteractionProgress,
+    InteractionReasonCode, InteractionRelationConstraint, InteractionRelationSourceConstraint,
+    InteractionResponse, InteractionResponseSpec, InteractionRoleCode, InteractionSessionId,
     InteractionShortcutCountSpec, InteractionShortcutDecision, InteractionShortcutPoint,
     InteractionShortcutPointKind, InteractionShortcutPreview, InteractionShortcutPreviewEntry,
     InteractionShortcutPreviewFamily, InteractionShortcutReply, InteractionShortcutResponseCode,
@@ -7420,6 +7420,9 @@ pub fn derive_viewer_interaction(
     viewer: PlayerId,
 ) -> ViewerInteraction {
     debug_assert_interaction_consistency(authoritative_state);
+    // Membership follows visibility, so it is built before any authorization,
+    // session or bounding gate and carried by every projection below.
+    let attachment_views = attachment_views_for_viewer(filtered_state);
     let authorized_submitters = turn_control::authorized_submitters(authoritative_state);
     let can_submit = authorized_submitters.contains(&viewer);
     let kind = waiting_for_kind(&authoritative_state.waiting_for);
@@ -7431,6 +7434,7 @@ pub fn derive_viewer_interaction(
             auto_pass_recommended: false,
             opportunities: Vec::new(),
             attachment_fans: BTreeMap::new(),
+            attachment_views: attachment_views.clone(),
             availability: InteractionAvailability::Terminal {
                 outcome: InteractionOutcomeCode::Terminal,
             },
@@ -7447,6 +7451,7 @@ pub fn derive_viewer_interaction(
             auto_pass_recommended: false,
             opportunities: Vec::new(),
             attachment_fans: BTreeMap::new(),
+            attachment_views: attachment_views.clone(),
             availability: InteractionAvailability::Waiting,
         };
     }
@@ -7465,6 +7470,7 @@ pub fn derive_viewer_interaction(
             auto_pass_recommended: false,
             opportunities: Vec::new(),
             attachment_fans: BTreeMap::new(),
+            attachment_views: attachment_views.clone(),
             availability: InteractionAvailability::Unsupported {
                 reason: InteractionReasonCode::AuthorityUnbound,
             },
@@ -7481,6 +7487,7 @@ pub fn derive_viewer_interaction(
             auto_pass_recommended: false,
             opportunities: Vec::new(),
             attachment_fans: BTreeMap::new(),
+            attachment_views: attachment_views.clone(),
             availability: InteractionAvailability::Unsupported {
                 reason: InteractionReasonCode::InvalidAuthorityState,
             },
@@ -7508,6 +7515,7 @@ pub fn derive_viewer_interaction(
             auto_pass_recommended: false,
             opportunities: Vec::new(),
             attachment_fans: BTreeMap::new(),
+            attachment_views: attachment_views.clone(),
             availability: InteractionAvailability::Unsupported {
                 reason: InteractionReasonCode::PayloadTooLarge,
             },
@@ -7554,6 +7562,8 @@ pub fn derive_viewer_interaction(
     let availability = first_progress
         .or(first_fallback)
         .unwrap_or(default_availability);
+    let mut attachment_views = attachment_views;
+    bind_attachment_view_submissions(&mut attachment_views, &attachment_fans);
     let mut view = ViewerInteraction {
         waiting_for_kind: kind,
         authorized_submitters: authorized_submitters
@@ -7567,11 +7577,13 @@ pub fn derive_viewer_interaction(
         ) && authoritative_state.auto_pass.contains_key(&viewer),
         opportunities,
         attachment_fans,
+        attachment_views,
         availability,
     };
     if bound_outbound_view(&view).is_err() {
         view.opportunities.clear();
         view.attachment_fans.clear();
+        view.attachment_views.clear();
         view.availability = InteractionAvailability::Unsupported {
             reason: InteractionReasonCode::PayloadTooLarge,
         };
@@ -7752,6 +7764,104 @@ fn attachment_fan_submission(
     })
 }
 
+/// Publish what is attached to every object the viewer can see.
+///
+/// Membership is a board fact — an attached permanent is an object in play
+/// (CR 301.5 / CR 303.4), not a property of the current prompt — so this reads
+/// the filtered projection alone and runs on every path, including the ones
+/// that carry no opportunity: an opponent's turn, an open prompt, a finished
+/// game. Publishing it only where picks exist would make an Aura disappear from
+/// the one surface that shows it as soon as a sibling Equipment became
+/// clickable.
+///
+/// Both directions of every relationship must agree, the same guard
+/// [`attachment_fans_for_object_choices`] applies, so authority-only or stale
+/// back-links cannot reach a consumer.
+fn attachment_views_for_viewer(
+    filtered_state: &GameState,
+) -> BTreeMap<u64, InteractionAttachmentView> {
+    let mut views = BTreeMap::new();
+    for host_id in filtered_state.objects.keys().copied() {
+        // Seeded with the host: an attachment cycle would otherwise walk
+        // forever, and no host may appear as a card beneath itself.
+        let mut seen = HashSet::from([host_id]);
+        let mut cards = Vec::new();
+        collect_attachment_subtree(filtered_state, host_id, &mut seen, &mut cards);
+        if cards.is_empty() || cards.len() > MAX_INTERACTION_LIST_LEN {
+            continue;
+        }
+        views.insert(
+            host_id.0,
+            InteractionAttachmentView {
+                host_id: host_id.0,
+                cards: cards
+                    .into_iter()
+                    .map(|object_id| InteractionAttachmentViewCard {
+                        object_id: object_id.0,
+                        submission: None,
+                    })
+                    .collect(),
+            },
+        );
+    }
+    if views.len() > MAX_INTERACTION_LIST_LEN {
+        return BTreeMap::new();
+    }
+    views
+}
+
+/// Depth-first pre-order, so a nested attachment follows the card it hangs on
+/// and consumers can lay the subtree out without re-deriving its shape.
+fn collect_attachment_subtree(
+    filtered_state: &GameState,
+    host_id: ObjectId,
+    seen: &mut HashSet<ObjectId>,
+    out: &mut Vec<ObjectId>,
+) {
+    let Some(host) = filtered_state.objects.get(&host_id) else {
+        return;
+    };
+    for child_id in &host.attachments {
+        let Some(child) = filtered_state.objects.get(child_id) else {
+            continue;
+        };
+        if !matches!(child.attached_to, Some(AttachTarget::Object(id)) if id == host_id) {
+            continue;
+        }
+        if !seen.insert(*child_id) {
+            continue;
+        }
+        out.push(*child_id);
+        collect_attachment_subtree(filtered_state, *child_id, seen, out);
+    }
+}
+
+/// Bind the published picks onto the membership the engine already owns.
+///
+/// The fans are keyed by the child's DIRECT host, so a card published beneath a
+/// nested attachment must still reach the view of the outermost host it hangs
+/// under. Object ids are unique, so a flat index is exact: it cannot move a
+/// pick onto a different card, and every host that legitimately lists the card
+/// gets the same submission.
+fn bind_attachment_view_submissions(
+    views: &mut BTreeMap<u64, InteractionAttachmentView>,
+    fans: &BTreeMap<u64, InteractionAttachmentFan>,
+) {
+    if fans.is_empty() {
+        return;
+    }
+    let submissions: HashMap<u64, &InteractionSubmission> = fans
+        .values()
+        .flat_map(|fan| fan.children.iter())
+        .map(|child| (child.object_id, &child.submission))
+        .collect();
+    for view in views.values_mut() {
+        for card in &mut view.cards {
+            card.submission = submissions.get(&card.object_id).map(|s| (*s).clone());
+        }
+    }
+}
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub struct InteractionSubmitError {
     pub code: InteractionReasonCode,
@@ -8063,6 +8173,17 @@ fn bound_outbound_view(view: &ViewerInteraction) -> Result<(), InteractionReason
             bound_outbound_response(&child.submission.response, &mut budget)?;
         }
     }
+    budget.list(view.attachment_views.len())?;
+    for attachment_view in view.attachment_views.values() {
+        budget.list(attachment_view.cards.len())?;
+        for card in &attachment_view.cards {
+            let Some(submission) = &card.submission else {
+                continue;
+            };
+            budget.string(submission.interaction_id.as_str())?;
+            bound_outbound_response(&submission.response, &mut budget)?;
+        }
+    }
     if let InteractionAvailability::ProgressAvailable { witness } = &view.availability {
         budget.string(witness.interaction_id.as_str())?;
         bound_outbound_response(&witness.response, &mut budget)?;
diff --git a/crates/engine/src/types/interaction.rs b/crates/engine/src/types/interaction.rs
index e4a18c8652..11bb432273 100644
--- a/crates/engine/src/types/interaction.rs
+++ b/crates/engine/src/types/interaction.rs
@@ -1189,6 +1189,47 @@ pub struct InteractionAttachmentFan {
     pub children: Vec<InteractionAttachmentFanChild>,
 }
 
+/// One card in a host's attachment view, with the engine's own submission when
+/// a one-step pick was published for it and `None` when it was not.
+///
+/// `None` is not "unavailable": it means this projection publishes no direct
+/// pick, and the card's remaining affordances stay on the normal interaction
+/// surface. Membership does not depend on it.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "interaction-bindings", derive(ts_rs::TS))]
+#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "interaction-bindings", ts(rename_all = "camelCase"))]
+pub struct InteractionAttachmentViewCard {
+    #[cfg_attr(feature = "interaction-bindings", ts(type = "number"))]
+    pub object_id: u64,
+    pub submission: Option<InteractionSubmission>,
+}
+
+/// Viewer-scoped membership of one host's attachment subtree: what is attached
+/// to this object, in the order the engine lays it out, whatever the viewer may
+/// currently do about it.
+///
+/// This is deliberately a different question from [`InteractionAttachmentFan`],
+/// which publishes the picks the viewer is *authorized to submit right now*. An
+/// attached permanent is an object on the battlefield (CR 301.5 / CR 303.4), so
+/// its membership follows visibility, not authorization — it must survive an
+/// opponent's turn, a prompt that owns the waiting state, and a terminal game.
+/// Consumers render and count this list; they must never rebuild it by scanning
+/// `attachments`, which carries authority-only relationship data.
+///
+/// Every card here is validated in both directions (the host lists the child and
+/// the child points back at the host) and read only from the filtered
+/// projection.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "interaction-bindings", derive(ts_rs::TS))]
+#[serde(rename_all = "camelCase")]
+#[cfg_attr(feature = "interaction-bindings", ts(rename_all = "camelCase"))]
+pub struct InteractionAttachmentView {
+    #[cfg_attr(feature = "interaction-bindings", ts(type = "number"))]
+    pub host_id: u64,
+    pub cards: Vec<InteractionAttachmentViewCard>,
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[cfg_attr(feature = "interaction-bindings", derive(ts_rs::TS))]
 #[serde(
@@ -1227,6 +1268,14 @@ pub struct ViewerInteraction {
         ts(type = "Record<number, InteractionAttachmentFan>")
     )]
     pub attachment_fans: BTreeMap<u64, InteractionAttachmentFan>,
+    /// What is attached to each visible object, keyed by that object. Published
+    /// on every projection, including the ones that carry no opportunity at all.
+    #[serde(default)]
+    #[cfg_attr(
+        feature = "interaction-bindings",
+        ts(type = "Record<number, InteractionAttachmentView>")
+    )]
+    pub attachment_views: BTreeMap<u64, InteractionAttachmentView>,
     pub availability: InteractionAvailability,
 }
 
diff --git a/crates/engine/tests/integration/interaction_contract.rs b/crates/engine/tests/integration/interaction_contract.rs
index 7c9f9f9e3f..85bc415698 100644
--- a/crates/engine/tests/integration/interaction_contract.rs
+++ b/crates/engine/tests/integration/interaction_contract.rs
@@ -458,6 +458,221 @@ fn attachment_fans_are_per_interaction_filtered_and_direct() {
     );
 }
 
+/// Attaches `attachment` to `host` and asserts the engine wrote both directions
+/// of the relationship, so a later membership assertion cannot pass on a
+/// half-built fixture.
+fn attach_and_assert_linked(state: &mut GameState, attachment: ObjectId, host: ObjectId) {
+    engine::game::effects::attach::attach_to(state, attachment, host);
+    assert!(
+        state.objects[&host].attachments.contains(&attachment),
+        "fixture guard: the host must list its attachment"
+    );
+    assert_eq!(
+        state.objects[&attachment].attached_to,
+        Some(engine::game::game_object::AttachTarget::Object(host)),
+        "fixture guard: the attachment must point back at its host"
+    );
+}
+
+/// A host wearing two attachments, one of them itself a host, with exactly one
+/// published pick in the whole subtree.
+///
+/// This is the shape that made membership and affordance look like one question:
+/// the engine publishes a fan per DIRECT host and only for a child with exactly
+/// one legal choice, so a consumer that read the fans as the membership list
+/// dropped the two cards nothing was published for — off the only surface that
+/// shows what is attached at all.
+#[test]
+fn attachment_views_publish_the_whole_subtree_whatever_is_pickable() {
+    let mut scenario = GameScenario::new();
+    scenario.at_phase(Phase::PreCombatMain);
+    let host = scenario.add_creature(P0, "View Host", 2, 2).id();
+    let inner = scenario.add_creature(P0, "View Inner", 1, 1).id();
+    let nested = scenario.add_creature(P0, "View Nested", 1, 1).id();
+    let sibling = scenario.add_creature(P0, "View Sibling", 1, 1).id();
+    let mut runner = scenario.build();
+    {
+        let state = runner.state_mut();
+        attach_and_assert_linked(state, inner, host);
+        attach_and_assert_linked(state, nested, inner);
+        attach_and_assert_linked(state, sibling, host);
+        state.objects.get_mut(&nested).unwrap().tapped = true;
+        // Only the nested card is a candidate, so only the INTERMEDIATE host
+        // gets a fan — the outer host gets none at all.
+        state.waiting_for = WaitingFor::ChooseUntapSubset {
+            player: P0,
+            group: vec![nested],
+            max: 1,
+        };
+        bind(state, "attachment-view");
+    }
+
+    let view = priority_view(runner.state());
+    assert_eq!(
+        view.attachment_fans.keys().copied().collect::<Vec<_>>(),
+        vec![inner.0],
+        "reach guard: the engine publishes its pick under the direct host only"
+    );
+
+    let outer = view
+        .attachment_views
+        .get(&host.0)
+        .expect("the outer host publishes its own membership");
+    assert_eq!(
+        outer
+            .cards
+            .iter()
+            .map(|card| card.object_id)
+            .collect::<Vec<_>>(),
+        vec![inner.0, nested.0, sibling.0],
+        "membership is the whole subtree in depth-first order, not the published picks"
+    );
+    assert!(
+        outer.cards[0].submission.is_none() && outer.cards[2].submission.is_none(),
+        "a card the engine published no pick for is still a member, without a submission"
+    );
+    let nested_submission = outer.cards[1]
+        .submission
+        .clone()
+        .expect("a pick published under a nested host reaches the outer host's view");
+
+    let intermediate = view
+        .attachment_views
+        .get(&inner.0)
+        .expect("an attachment that is itself a host publishes its own membership");
+    assert_eq!(
+        intermediate
+            .cards
+            .iter()
+            .map(|card| card.object_id)
+            .collect::<Vec<_>>(),
+        vec![nested.0],
+        "a nested host lists what hangs on it, and never itself"
+    );
+
+    submit_interaction(runner.state_mut(), P0, nested_submission).expect(
+        "the submission published in the view resolves through production interaction dispatch",
+    );
+    assert!(
+        !runner.state().objects[&nested].tapped,
+        "the nested card's published submission applies its selected untap"
+    );
+}
+
+/// Membership answers a different question than the fan does, and must not
+/// inherit its authorization gate: an attached permanent is an object in play
+/// (CR 301.5 / CR 303.4), so it stays visible while another player holds the
+/// turn. Both directions of the relationship still have to agree.
+#[test]
+fn attachment_views_follow_visibility_while_fans_follow_authorization() {
+    let mut scenario = GameScenario::new();
+    scenario.at_phase(Phase::PreCombatMain);
+    let host = scenario.add_creature(P0, "Link Host", 2, 2).id();
+    let attachment = scenario.add_creature(P0, "Link Attachment", 1, 1).id();
+    let mut runner = scenario.build();
+    {
+        let state = runner.state_mut();
+        attach_and_assert_linked(state, attachment, host);
+        state.objects.get_mut(&attachment).unwrap().tapped = true;
+        state.waiting_for = WaitingFor::ChooseUntapSubset {
+            player: P0,
+            group: vec![attachment],
+            max: 1,
+        };
+        bind(state, "attachment-view-links");
+    }
+
+    let unauthorized = viewer_interaction(runner.state(), P1);
+    assert!(
+        unauthorized.attachment_fans.is_empty(),
+        "reach guard: the pick sidecar stays authorization-scoped"
+    );
+    let opponent_view = unauthorized
+        .attachment_views
+        .get(&host.0)
+        .expect("the opponent still sees what is attached to a battlefield permanent");
+    assert_eq!(
+        opponent_view
+            .cards
+            .iter()
+            .map(|card| card.object_id)
+            .collect::<Vec<_>>(),
+        vec![attachment.0]
+    );
+    assert!(
+        opponent_view.cards[0].submission.is_none(),
+        "a viewer who may not submit is offered nothing to submit"
+    );
+
+    let mut stale_back_link = filter_state_for_viewer(runner.state(), P0);
+    stale_back_link
+        .objects
+        .get_mut(&host)
+        .expect("fixture host remains visible")
+        .attachments
+        .clear();
+    assert!(
+        derive_viewer_interaction(runner.state(), &stale_back_link, P0)
+            .attachment_views
+            .is_empty(),
+        "a host that no longer lists the attachment publishes no membership for it"
+    );
+
+    let mut stale_forward_link = filter_state_for_viewer(runner.state(), P0);
+    stale_forward_link
+        .objects
+        .get_mut(&attachment)
+        .expect("fixture attachment remains visible")
+        .attached_to = None;
+    assert!(
+        derive_viewer_interaction(runner.state(), &stale_forward_link, P0)
+            .attachment_views
+            .is_empty(),
+        "an attachment that no longer points back at its host publishes no membership"
+    );
+}
+
+/// The projection crosses the generated adapter as the client reads it: camel
+/// case on the wire, a `null` submission for a card with no published pick.
+#[test]
+fn attachment_views_survive_the_adapter_round_trip() {
+    let mut scenario = GameScenario::new();
+    scenario.at_phase(Phase::PreCombatMain);
+    let host = scenario.add_creature(P0, "Wire Host", 2, 2).id();
+    let attachment = scenario.add_creature(P0, "Wire Attachment", 1, 1).id();
+    let mut runner = scenario.build();
+    {
+        let state = runner.state_mut();
+        attach_and_assert_linked(state, attachment, host);
+        bind(state, "attachment-view-wire");
+    }
+
+    let view = priority_view(runner.state());
+    assert!(view.attachment_views.contains_key(&host.0));
+    let wire = serde_json::to_string(&view).expect("serialize the viewer projection");
+    assert!(
+        wire.contains("\"attachmentViews\"") && wire.contains("\"objectId\""),
+        "the adapter reads camel case: {wire}"
+    );
+    assert!(
+        wire.contains("\"submission\":null"),
+        "a member with no published pick crosses the wire as null: {wire}"
+    );
+    let decoded: engine::types::interaction::ViewerInteraction =
+        serde_json::from_str(&wire).expect("deserialize the viewer projection");
+    assert_eq!(decoded.attachment_views, view.attachment_views);
+
+    // A projection written before this field existed still loads.
+    let mut legacy: serde_json::Value = serde_json::from_str(&wire).expect("reparse as value");
+    legacy
+        .as_object_mut()
+        .expect("the projection is an object")
+        .remove("attachmentViews");
+    let legacy: engine::types::interaction::ViewerInteraction =
+        serde_json::from_value(legacy).expect("a projection without the field still loads");
+    assert!(legacy.attachment_views.is_empty());
+}
+
 #[test]
 fn authority_requires_explicit_binding_and_rebinding_invalidates_old_capabilities() {
     let mut state = GameState::new_two_player(42);

From 92fdd5652bc7a99bde553ff5050f29c43ecc0e91 Mon Sep 17 00:00:00 2001
From: cuinhellcat <217210902+cuinhellcat@users.noreply.github.com>
Date: Fri, 14 Aug 2026 21:29:09 +0200
Subject: [PATCH 3/8] fix(engine): bound every viewer projection through one
 exit

Membership is derived before the authorization, session and slot gates, so
the terminal, unauthorized, unbound-authority, invalid-serial and
oversized-slot returns each carried an attachment map that only the derived
path ever charged against the outbound budget. An early return could
therefore serialize a visible attachment tree of any size.

`derive_viewer_interaction` now leaves through a single
`finalize_viewer_interaction`, so one aggregate budget governs every
outward projection and failure drops the unbounded lists with
PayloadTooLarge instead of shipping a truncated payload.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/engine/src/game/interaction.rs         | 38 +++++++----
 .../tests/integration/interaction_contract.rs | 63 +++++++++++++++++++
 2 files changed, 89 insertions(+), 12 deletions(-)

diff --git a/crates/engine/src/game/interaction.rs b/crates/engine/src/game/interaction.rs
index 535bda3743..6a2e30681d 100644
--- a/crates/engine/src/game/interaction.rs
+++ b/crates/engine/src/game/interaction.rs
@@ -7427,7 +7427,7 @@ pub fn derive_viewer_interaction(
     let can_submit = authorized_submitters.contains(&viewer);
     let kind = waiting_for_kind(&authoritative_state.waiting_for);
     if kind.terminal {
-        return ViewerInteraction {
+        return finalize_viewer_interaction(ViewerInteraction {
             waiting_for_kind: kind,
             authorized_submitters: Vec::new(),
             can_submit: false,
@@ -7438,10 +7438,10 @@ pub fn derive_viewer_interaction(
             availability: InteractionAvailability::Terminal {
                 outcome: InteractionOutcomeCode::Terminal,
             },
-        };
+        });
     }
     if !can_submit {
-        return ViewerInteraction {
+        return finalize_viewer_interaction(ViewerInteraction {
             waiting_for_kind: kind,
             authorized_submitters: authorized_submitters
                 .into_iter()
@@ -7453,14 +7453,14 @@ pub fn derive_viewer_interaction(
             attachment_fans: BTreeMap::new(),
             attachment_views: attachment_views.clone(),
             availability: InteractionAvailability::Waiting,
-        };
+        });
     }
     if authoritative_state
         .interaction_session_id
         .as_ref()
         .is_none_or(|session| !interaction_session_is_valid(session))
     {
-        return ViewerInteraction {
+        return finalize_viewer_interaction(ViewerInteraction {
             waiting_for_kind: kind,
             authorized_submitters: authorized_submitters
                 .into_iter()
@@ -7474,10 +7474,10 @@ pub fn derive_viewer_interaction(
             availability: InteractionAvailability::Unsupported {
                 reason: InteractionReasonCode::AuthorityUnbound,
             },
-        };
+        });
     }
     if !interaction_serial_is_valid(&authoritative_state.next_interaction_serial) {
-        return ViewerInteraction {
+        return finalize_viewer_interaction(ViewerInteraction {
             waiting_for_kind: kind,
             authorized_submitters: authorized_submitters
                 .into_iter()
@@ -7491,7 +7491,7 @@ pub fn derive_viewer_interaction(
             availability: InteractionAvailability::Unsupported {
                 reason: InteractionReasonCode::InvalidAuthorityState,
             },
-        };
+        });
     }
 
     let slots: Vec<_> = authoritative_state
@@ -7505,7 +7505,7 @@ pub fn derive_viewer_interaction(
         })
         .collect();
     if slots.len() > MAX_INTERACTION_LIST_LEN {
-        return ViewerInteraction {
+        return finalize_viewer_interaction(ViewerInteraction {
             waiting_for_kind: kind,
             authorized_submitters: authorized_submitters
                 .into_iter()
@@ -7519,7 +7519,7 @@ pub fn derive_viewer_interaction(
             availability: InteractionAvailability::Unsupported {
                 reason: InteractionReasonCode::PayloadTooLarge,
             },
-        };
+        });
     }
     let mut opportunities = Vec::with_capacity(slots.len());
     let mut attachment_fans = BTreeMap::new();
@@ -7564,7 +7564,7 @@ pub fn derive_viewer_interaction(
         .unwrap_or(default_availability);
     let mut attachment_views = attachment_views;
     bind_attachment_view_submissions(&mut attachment_views, &attachment_fans);
-    let mut view = ViewerInteraction {
+    finalize_viewer_interaction(ViewerInteraction {
         waiting_for_kind: kind,
         authorized_submitters: authorized_submitters
             .into_iter()
@@ -7579,7 +7579,21 @@ pub fn derive_viewer_interaction(
         attachment_fans,
         attachment_views,
         availability,
-    };
+    })
+}
+
+/// The single exit of [`derive_viewer_interaction`]: every projection the engine
+/// hands outward — terminal, unauthorized, unbound-authority, invalid-serial,
+/// oversized-slot and the derived one alike — leaves through here, so one
+/// aggregate budget governs the whole payload. Membership is built before the
+/// authorization and session gates, so an early return carries just as much of
+/// it as the derived path does; charging it only on the derived path would leave
+/// the other five able to serialize an unbounded attachment tree.
+///
+/// Failing the budget fails closed: the unbounded lists are dropped and the
+/// availability states why, rather than shipping a truncated payload that reads
+/// as an authoritative "nothing is attached".
+fn finalize_viewer_interaction(mut view: ViewerInteraction) -> ViewerInteraction {
     if bound_outbound_view(&view).is_err() {
         view.opportunities.clear();
         view.attachment_fans.clear();
diff --git a/crates/engine/tests/integration/interaction_contract.rs b/crates/engine/tests/integration/interaction_contract.rs
index 85bc415698..d22a1349e6 100644
--- a/crates/engine/tests/integration/interaction_contract.rs
+++ b/crates/engine/tests/integration/interaction_contract.rs
@@ -673,6 +673,69 @@ fn attachment_views_survive_the_adapter_round_trip() {
     assert!(legacy.attachment_views.is_empty());
 }
 
+/// Membership is derived before the authorization, session and slot gates, so
+/// an early return carries as much of it as the derived path does. Only the
+/// whole-projection bound charges the map and every card in it: each view below
+/// is inside the per-view cap, and it is their SUM that has to fail closed —
+/// otherwise a viewer who may not submit anything at all still receives an
+/// attachment tree of unbounded size.
+///
+/// The same early return ships its membership normally while it fits — that is
+/// `attachment_views_follow_visibility_while_fans_follow_authorization`.
+#[test]
+fn an_early_return_fails_closed_on_the_aggregate_attachment_budget() {
+    let mut scenario = GameScenario::new();
+    scenario.at_phase(Phase::PreCombatMain);
+    let host = scenario.add_creature(P0, "Budget Host", 2, 2).id();
+    let seed = scenario.add_creature(P0, "Budget Attachment", 1, 1).id();
+    let mut runner = scenario.build();
+    {
+        let state = runner.state_mut();
+        attach_and_assert_linked(state, seed, host);
+        // Replay the shape the engine just wrote until the host wears the
+        // per-view maximum, so no single view is oversized on its own.
+        let engine_written = state.objects[&seed].clone();
+        let mut next_id = state.objects.keys().map(|id| id.0).max().unwrap_or(0) + 1;
+        while state.objects[&host].attachments.len() < MAX_INTERACTION_LIST_LEN {
+            let id = ObjectId(next_id);
+            next_id += 1;
+            let mut copy = engine_written.clone();
+            copy.id = id;
+            state.objects.insert(id, copy);
+            state.battlefield.push_back(id);
+            state.objects.get_mut(&host).unwrap().attachments.push(id);
+        }
+        bind(state, "attachment-view-budget");
+    }
+    assert!(
+        runner.state().objects[&host]
+            .attachments
+            .iter()
+            .all(|id| runner.state().objects[id].attached_to
+                == runner.state().objects[&seed].attached_to),
+        "fixture guard: every filled row carries the same back-link the engine wrote"
+    );
+
+    let unauthorized = viewer_interaction(runner.state(), P1);
+    assert_eq!(
+        unauthorized.availability,
+        InteractionAvailability::Unsupported {
+            reason: InteractionReasonCode::PayloadTooLarge,
+        },
+        "an early return that cannot be bounded says so instead of shipping the payload"
+    );
+    assert!(
+        unauthorized.attachment_views.is_empty()
+            && unauthorized.attachment_fans.is_empty()
+            && unauthorized.opportunities.is_empty(),
+        "failing the budget drops every unbounded list rather than truncating one"
+    );
+    assert!(
+        !unauthorized.can_submit,
+        "the fail-closed projection keeps the authority answer it was already carrying"
+    );
+}
+
 #[test]
 fn authority_requires_explicit_binding_and_rebinding_invalidates_old_capabilities() {
     let mut state = GameState::new_two_player(42);

From f61d009ad01017953af99bcb05b43da6fc9813dc Mon Sep 17 00:00:00 2001
From: cuinhellcat <217210902+cuinhellcat@users.noreply.github.com>
Date: Fri, 14 Aug 2026 22:46:35 +0200
Subject: [PATCH 4/8] fix(engine): let attachment-view overflow reach the
 budget gate

The membership derivation absorbed its own overflow: a host whose subtree
passed MAX_INTERACTION_LIST_LEN was skipped, and an over-limit host map was
replaced by an empty one. Both left the finalizer a small, plausible
projection with nothing to object to, so the viewer read a bounded empty map
as an authoritative "nothing is attached".

`attachment_views_for_viewer` now returns Result and the reason code travels
to `finalize_viewer_interaction`, which installs the membership and owns the
single fail-closed answer for both derivation and aggregate overflow.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/engine/src/game/interaction.rs         | 229 +++++++++++-------
 .../tests/integration/interaction_contract.rs | 117 ++++++++-
 2 files changed, 242 insertions(+), 104 deletions(-)

diff --git a/crates/engine/src/game/interaction.rs b/crates/engine/src/game/interaction.rs
index 6a2e30681d..2481314d9a 100644
--- a/crates/engine/src/game/interaction.rs
+++ b/crates/engine/src/game/interaction.rs
@@ -7421,77 +7421,91 @@ pub fn derive_viewer_interaction(
 ) -> ViewerInteraction {
     debug_assert_interaction_consistency(authoritative_state);
     // Membership follows visibility, so it is built before any authorization,
-    // session or bounding gate and carried by every projection below.
+    // session or bounding gate and carried by every projection below. Overflow
+    // is a value here, not a silently emptied map: the finalizer is the only
+    // place allowed to decide what an unbounded projection becomes.
     let attachment_views = attachment_views_for_viewer(filtered_state);
     let authorized_submitters = turn_control::authorized_submitters(authoritative_state);
     let can_submit = authorized_submitters.contains(&viewer);
     let kind = waiting_for_kind(&authoritative_state.waiting_for);
     if kind.terminal {
-        return finalize_viewer_interaction(ViewerInteraction {
-            waiting_for_kind: kind,
-            authorized_submitters: Vec::new(),
-            can_submit: false,
-            auto_pass_recommended: false,
-            opportunities: Vec::new(),
-            attachment_fans: BTreeMap::new(),
-            attachment_views: attachment_views.clone(),
-            availability: InteractionAvailability::Terminal {
-                outcome: InteractionOutcomeCode::Terminal,
+        return finalize_viewer_interaction(
+            ViewerInteraction {
+                waiting_for_kind: kind,
+                authorized_submitters: Vec::new(),
+                can_submit: false,
+                auto_pass_recommended: false,
+                opportunities: Vec::new(),
+                attachment_fans: BTreeMap::new(),
+                attachment_views: BTreeMap::new(),
+                availability: InteractionAvailability::Terminal {
+                    outcome: InteractionOutcomeCode::Terminal,
+                },
             },
-        });
+            attachment_views.clone(),
+        );
     }
     if !can_submit {
-        return finalize_viewer_interaction(ViewerInteraction {
-            waiting_for_kind: kind,
-            authorized_submitters: authorized_submitters
-                .into_iter()
-                .map(|player| player.0)
-                .collect(),
-            can_submit: false,
-            auto_pass_recommended: false,
-            opportunities: Vec::new(),
-            attachment_fans: BTreeMap::new(),
-            attachment_views: attachment_views.clone(),
-            availability: InteractionAvailability::Waiting,
-        });
+        return finalize_viewer_interaction(
+            ViewerInteraction {
+                waiting_for_kind: kind,
+                authorized_submitters: authorized_submitters
+                    .into_iter()
+                    .map(|player| player.0)
+                    .collect(),
+                can_submit: false,
+                auto_pass_recommended: false,
+                opportunities: Vec::new(),
+                attachment_fans: BTreeMap::new(),
+                attachment_views: BTreeMap::new(),
+                availability: InteractionAvailability::Waiting,
+            },
+            attachment_views.clone(),
+        );
     }
     if authoritative_state
         .interaction_session_id
         .as_ref()
         .is_none_or(|session| !interaction_session_is_valid(session))
     {
-        return finalize_viewer_interaction(ViewerInteraction {
-            waiting_for_kind: kind,
-            authorized_submitters: authorized_submitters
-                .into_iter()
-                .map(|player| player.0)
-                .collect(),
-            can_submit: true,
-            auto_pass_recommended: false,
-            opportunities: Vec::new(),
-            attachment_fans: BTreeMap::new(),
-            attachment_views: attachment_views.clone(),
-            availability: InteractionAvailability::Unsupported {
-                reason: InteractionReasonCode::AuthorityUnbound,
+        return finalize_viewer_interaction(
+            ViewerInteraction {
+                waiting_for_kind: kind,
+                authorized_submitters: authorized_submitters
+                    .into_iter()
+                    .map(|player| player.0)
+                    .collect(),
+                can_submit: true,
+                auto_pass_recommended: false,
+                opportunities: Vec::new(),
+                attachment_fans: BTreeMap::new(),
+                attachment_views: BTreeMap::new(),
+                availability: InteractionAvailability::Unsupported {
+                    reason: InteractionReasonCode::AuthorityUnbound,
+                },
             },
-        });
+            attachment_views.clone(),
+        );
     }
     if !interaction_serial_is_valid(&authoritative_state.next_interaction_serial) {
-        return finalize_viewer_interaction(ViewerInteraction {
-            waiting_for_kind: kind,
-            authorized_submitters: authorized_submitters
-                .into_iter()
-                .map(|player| player.0)
-                .collect(),
-            can_submit: true,
-            auto_pass_recommended: false,
-            opportunities: Vec::new(),
-            attachment_fans: BTreeMap::new(),
-            attachment_views: attachment_views.clone(),
-            availability: InteractionAvailability::Unsupported {
-                reason: InteractionReasonCode::InvalidAuthorityState,
+        return finalize_viewer_interaction(
+            ViewerInteraction {
+                waiting_for_kind: kind,
+                authorized_submitters: authorized_submitters
+                    .into_iter()
+                    .map(|player| player.0)
+                    .collect(),
+                can_submit: true,
+                auto_pass_recommended: false,
+                opportunities: Vec::new(),
+                attachment_fans: BTreeMap::new(),
+                attachment_views: BTreeMap::new(),
+                availability: InteractionAvailability::Unsupported {
+                    reason: InteractionReasonCode::InvalidAuthorityState,
+                },
             },
-        });
+            attachment_views.clone(),
+        );
     }
 
     let slots: Vec<_> = authoritative_state
@@ -7505,21 +7519,24 @@ pub fn derive_viewer_interaction(
         })
         .collect();
     if slots.len() > MAX_INTERACTION_LIST_LEN {
-        return finalize_viewer_interaction(ViewerInteraction {
-            waiting_for_kind: kind,
-            authorized_submitters: authorized_submitters
-                .into_iter()
-                .map(|player| player.0)
-                .collect(),
-            can_submit: true,
-            auto_pass_recommended: false,
-            opportunities: Vec::new(),
-            attachment_fans: BTreeMap::new(),
-            attachment_views: attachment_views.clone(),
-            availability: InteractionAvailability::Unsupported {
-                reason: InteractionReasonCode::PayloadTooLarge,
+        return finalize_viewer_interaction(
+            ViewerInteraction {
+                waiting_for_kind: kind,
+                authorized_submitters: authorized_submitters
+                    .into_iter()
+                    .map(|player| player.0)
+                    .collect(),
+                can_submit: true,
+                auto_pass_recommended: false,
+                opportunities: Vec::new(),
+                attachment_fans: BTreeMap::new(),
+                attachment_views: BTreeMap::new(),
+                availability: InteractionAvailability::Unsupported {
+                    reason: InteractionReasonCode::PayloadTooLarge,
+                },
             },
-        });
+            attachment_views.clone(),
+        );
     }
     let mut opportunities = Vec::with_capacity(slots.len());
     let mut attachment_fans = BTreeMap::new();
@@ -7562,24 +7579,29 @@ pub fn derive_viewer_interaction(
     let availability = first_progress
         .or(first_fallback)
         .unwrap_or(default_availability);
-    let mut attachment_views = attachment_views;
-    bind_attachment_view_submissions(&mut attachment_views, &attachment_fans);
-    finalize_viewer_interaction(ViewerInteraction {
-        waiting_for_kind: kind,
-        authorized_submitters: authorized_submitters
-            .into_iter()
-            .map(|player| player.0)
-            .collect(),
-        can_submit: true,
-        auto_pass_recommended: matches!(
-            authoritative_state.waiting_for,
-            WaitingFor::Priority { .. }
-        ) && authoritative_state.auto_pass.contains_key(&viewer),
-        opportunities,
-        attachment_fans,
+    let attachment_views = attachment_views.map(|mut views| {
+        bind_attachment_view_submissions(&mut views, &attachment_fans);
+        views
+    });
+    finalize_viewer_interaction(
+        ViewerInteraction {
+            waiting_for_kind: kind,
+            authorized_submitters: authorized_submitters
+                .into_iter()
+                .map(|player| player.0)
+                .collect(),
+            can_submit: true,
+            auto_pass_recommended: matches!(
+                authoritative_state.waiting_for,
+                WaitingFor::Priority { .. }
+            ) && authoritative_state.auto_pass.contains_key(&viewer),
+            opportunities,
+            attachment_fans,
+            attachment_views: BTreeMap::new(),
+            availability,
+        },
         attachment_views,
-        availability,
-    })
+    )
 }
 
 /// The single exit of [`derive_viewer_interaction`]: every projection the engine
@@ -7593,14 +7615,25 @@ pub fn derive_viewer_interaction(
 /// Failing the budget fails closed: the unbounded lists are dropped and the
 /// availability states why, rather than shipping a truncated payload that reads
 /// as an authoritative "nothing is attached".
-fn finalize_viewer_interaction(mut view: ViewerInteraction) -> ViewerInteraction {
-    if bound_outbound_view(&view).is_err() {
+///
+/// `attachment_views` arrives as the projection or as the reason it could not be
+/// produced within the bound, and is installed here rather than by the caller.
+/// A membership map that overflowed inside its own derivation is therefore just
+/// as visible to this gate as one that overflows the aggregate: both reach the
+/// same fail-closed answer, and neither can leave as a plausible empty map.
+fn finalize_viewer_interaction(
+    mut view: ViewerInteraction,
+    attachment_views: Result<BTreeMap<u64, InteractionAttachmentView>, InteractionReasonCode>,
+) -> ViewerInteraction {
+    let bounded = attachment_views.and_then(|views| {
+        view.attachment_views = views;
+        bound_outbound_view(&view)
+    });
+    if let Err(reason) = bounded {
         view.opportunities.clear();
         view.attachment_fans.clear();
         view.attachment_views.clear();
-        view.availability = InteractionAvailability::Unsupported {
-            reason: InteractionReasonCode::PayloadTooLarge,
-        };
+        view.availability = InteractionAvailability::Unsupported { reason };
     }
     view
 }
@@ -7791,9 +7824,16 @@ fn attachment_fan_submission(
 /// Both directions of every relationship must agree, the same guard
 /// [`attachment_fans_for_object_choices`] applies, so authority-only or stale
 /// back-links cannot reach a consumer.
+///
+/// Overflow is returned, never absorbed. Dropping an oversized host or emptying
+/// an oversized map here would hand the caller a bounded, plausible projection
+/// that states the opposite of the truth — "nothing is attached" — and the
+/// budget gate downstream would have nothing left to object to. The reason code
+/// travels instead, and [`finalize_viewer_interaction`] decides what the viewer
+/// is told.
 fn attachment_views_for_viewer(
     filtered_state: &GameState,
-) -> BTreeMap<u64, InteractionAttachmentView> {
+) -> Result<BTreeMap<u64, InteractionAttachmentView>, InteractionReasonCode> {
     let mut views = BTreeMap::new();
     for host_id in filtered_state.objects.keys().copied() {
         // Seeded with the host: an attachment cycle would otherwise walk
@@ -7801,7 +7841,10 @@ fn attachment_views_for_viewer(
         let mut seen = HashSet::from([host_id]);
         let mut cards = Vec::new();
         collect_attachment_subtree(filtered_state, host_id, &mut seen, &mut cards);
-        if cards.is_empty() || cards.len() > MAX_INTERACTION_LIST_LEN {
+        if cards.len() > MAX_INTERACTION_LIST_LEN {
+            return Err(InteractionReasonCode::PayloadTooLarge);
+        }
+        if cards.is_empty() {
             continue;
         }
         views.insert(
@@ -7819,9 +7862,9 @@ fn attachment_views_for_viewer(
         );
     }
     if views.len() > MAX_INTERACTION_LIST_LEN {
-        return BTreeMap::new();
+        return Err(InteractionReasonCode::PayloadTooLarge);
     }
-    views
+    Ok(views)
 }
 
 /// Depth-first pre-order, so a nested attachment follows the card it hangs on
diff --git a/crates/engine/tests/integration/interaction_contract.rs b/crates/engine/tests/integration/interaction_contract.rs
index d22a1349e6..9134cbc729 100644
--- a/crates/engine/tests/integration/interaction_contract.rs
+++ b/crates/engine/tests/integration/interaction_contract.rs
@@ -673,6 +673,37 @@ fn attachment_views_survive_the_adapter_round_trip() {
     assert!(legacy.attachment_views.is_empty());
 }
 
+/// Hangs one more copy of the engine-written attachment `seed` on `host`,
+/// writing both directions exactly as `attach::attach_to` wrote them for the
+/// seed itself. Cloning rather than re-attaching keeps a ten-thousand-row
+/// fixture cheap without inventing a relationship shape of its own.
+fn clone_attachment_onto(
+    state: &mut GameState,
+    seed: ObjectId,
+    host: ObjectId,
+    next_id: &mut u64,
+) -> ObjectId {
+    let id = ObjectId(*next_id);
+    *next_id += 1;
+    let mut copy = state.objects[&seed].clone();
+    copy.id = id;
+    copy.attachments.clear();
+    copy.attached_to = Some(engine::game::game_object::AttachTarget::Object(host));
+    state.objects.insert(id, copy);
+    state.battlefield.push_back(id);
+    state
+        .objects
+        .get_mut(&host)
+        .expect("host exists")
+        .attachments
+        .push(id);
+    id
+}
+
+fn next_object_id(state: &GameState) -> u64 {
+    state.objects.keys().map(|id| id.0).max().unwrap_or(0) + 1
+}
+
 /// Membership is derived before the authorization, session and slot gates, so
 /// an early return carries as much of it as the derived path does. Only the
 /// whole-projection bound charges the map and every card in it: each view below
@@ -692,18 +723,11 @@ fn an_early_return_fails_closed_on_the_aggregate_attachment_budget() {
     {
         let state = runner.state_mut();
         attach_and_assert_linked(state, seed, host);
-        // Replay the shape the engine just wrote until the host wears the
-        // per-view maximum, so no single view is oversized on its own.
-        let engine_written = state.objects[&seed].clone();
-        let mut next_id = state.objects.keys().map(|id| id.0).max().unwrap_or(0) + 1;
+        // Fill the host to the per-view maximum, so no single view is oversized
+        // on its own and only the aggregate can object.
+        let mut next_id = next_object_id(state);
         while state.objects[&host].attachments.len() < MAX_INTERACTION_LIST_LEN {
-            let id = ObjectId(next_id);
-            next_id += 1;
-            let mut copy = engine_written.clone();
-            copy.id = id;
-            state.objects.insert(id, copy);
-            state.battlefield.push_back(id);
-            state.objects.get_mut(&host).unwrap().attachments.push(id);
+            clone_attachment_onto(state, seed, host, &mut next_id);
         }
         bind(state, "attachment-view-budget");
     }
@@ -736,6 +760,77 @@ fn an_early_return_fails_closed_on_the_aggregate_attachment_budget() {
     );
 }
 
+/// A single direct host whose own subtree passes the per-view cap.
+///
+/// This shape used to be absorbed inside the membership derivation — the host
+/// was skipped, and an over-limit host map was replaced by an empty one — which
+/// handed the budget gate a small, plausible projection it had no reason to
+/// reject. The viewer then read a bounded empty map as an authoritative
+/// "nothing is attached", which is the one answer the engine must never invent.
+///
+/// Read through the unauthorized early return, which is the cheap seat: the
+/// derived path would enumerate every legal action over ten thousand
+/// permanents, and `a_deep_attachment_chain_fails_closed_on_the_aggregate`
+/// already carries the same claim through it.
+#[test]
+fn an_oversized_attachment_tree_fails_closed_instead_of_publishing_an_empty_map() {
+    let mut scenario = GameScenario::new();
+    scenario.at_phase(Phase::PreCombatMain);
+    let host = scenario.add_creature(P0, "Wide Host", 2, 2).id();
+    let seed = scenario.add_creature(P0, "Wide Attachment", 1, 1).id();
+    let mut runner = scenario.build();
+    {
+        let state = runner.state_mut();
+        attach_and_assert_linked(state, seed, host);
+        let mut next_id = next_object_id(state);
+        while state.objects[&host].attachments.len() <= MAX_INTERACTION_LIST_LEN {
+            clone_attachment_onto(state, seed, host, &mut next_id);
+        }
+        bind(state, "attachment-view-wide");
+    }
+    let wide = viewer_interaction(runner.state(), P1);
+    assert_eq!(
+        wide.availability,
+        InteractionAvailability::Unsupported {
+            reason: InteractionReasonCode::PayloadTooLarge,
+        },
+        "a host whose own subtree is over the cap fails closed; it is not skipped"
+    );
+    assert!(wide.attachment_views.is_empty() && wide.opportunities.is_empty());
+}
+
+/// The nesting half of the same claim, read through the DERIVED path: every
+/// view is small, and it is the tree that is too large.
+#[test]
+fn a_deep_attachment_chain_fails_closed_on_the_aggregate() {
+    const CHAIN: usize = 200;
+    let mut scenario = GameScenario::new();
+    scenario.at_phase(Phase::PreCombatMain);
+    let root = scenario.add_creature(P0, "Chain Root", 2, 2).id();
+    let seed = scenario.add_creature(P0, "Chain Link", 1, 1).id();
+    let mut runner = scenario.build();
+    {
+        let state = runner.state_mut();
+        attach_and_assert_linked(state, seed, root);
+        let mut next_id = next_object_id(state);
+        let mut tip = seed;
+        for _ in 1..CHAIN {
+            tip = clone_attachment_onto(state, seed, tip, &mut next_id);
+        }
+        bind(state, "attachment-view-deep");
+    }
+    let deep = priority_view(runner.state());
+    assert_eq!(
+        deep.availability,
+        InteractionAvailability::Unsupported {
+            reason: InteractionReasonCode::PayloadTooLarge,
+        },
+        "nesting sums the same way: {CHAIN} views of at most {CHAIN} cards each \
+         exceed the aggregate even though none exceeds the per-view cap"
+    );
+    assert!(deep.attachment_views.is_empty());
+}
+
 #[test]
 fn authority_requires_explicit_binding_and_rebinding_invalidates_old_capabilities() {
     let mut state = GameState::new_two_player(42);

From be13c2abdd0f2793d0ff37730a69cef0e46dafc1 Mon Sep 17 00:00:00 2001
From: cuinhellcat <217210902+cuinhellcat@users.noreply.github.com>
Date: Sat, 15 Aug 2026 11:15:19 +0200
Subject: [PATCH 5/8] fix(engine): bound the attachment view while it is
 derived
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`attachment_views_for_viewer` built each host's whole descendant tree and
only then asked whether it fit, and walked those descendants again for
every ancestor above them. The aggregate bound in `bound_outbound_view`
did reject the finished payload, so the ANSWER was already fail-closed —
but it was reached only after the construction work was done.

A chain 10 000 links long is the worst case: it is the longest chain in
which no single view exceeds the per-view cap, so the per-host check never
fires and the derivation runs to completion. Measured on the new fixture,
that costs 23.2 s and peaks at 7.4 GB resident for a payload of 49 995 000
card entries. CR 732.2's runaway-cascade guard permits one dispatch to
grow the board by 16 000 objects, so this is a reachable board rather than
an invalid fixture, and the engine ships to WASM, where 7.4 GB is
linear-memory exhaustion rather than a slow frame.

The walk is now iterative — its depth is the attachment chain's depth,
which is a game-controlled quantity and does not belong on the call stack
— and it carries the running aggregate, stopping one card past the budget.
The same fixture now costs 0.16 s. The running total is charged by
addition rather than against a remaining allowance, so the bound cannot
underflow if the accounting slips.

Every card charged here is charged again by `bound_outbound_view`
alongside the map, the fans and the opportunities, so the derivation's
total is a lower bound on the finalizer's: it can never refuse a payload
the finalizer would have accepted, and the finalizer stays the single
authority on what the viewer is told.

Regressions: `a_cap_depth_attachment_chain_is_refused_before_it_is_built`
(the 10 000-link worst case, read through the early return, which reaches
the same derivation without the 109 s of action enumeration the derived
path owes over that board) and the existing chain row, deepened from 200
to 1 000 links so it exercises the derived path against a payload of
499 500 cards.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/engine/src/game/interaction.rs         | 80 ++++++++++++++-----
 .../tests/integration/interaction_contract.rs | 65 ++++++++++++++-
 2 files changed, 123 insertions(+), 22 deletions(-)

diff --git a/crates/engine/src/game/interaction.rs b/crates/engine/src/game/interaction.rs
index 2481314d9a..04ce780567 100644
--- a/crates/engine/src/game/interaction.rs
+++ b/crates/engine/src/game/interaction.rs
@@ -7835,18 +7835,24 @@ fn attachment_views_for_viewer(
     filtered_state: &GameState,
 ) -> Result<BTreeMap<u64, InteractionAttachmentView>, InteractionReasonCode> {
     let mut views = BTreeMap::new();
+    // Cards materialized so far, across every host. Charged BEFORE each subtree
+    // is built rather than measured after, so an over-budget projection is
+    // refused while it is still small.
+    //
+    // Every card the derivation emits is charged again by
+    // `bound_outbound_view`, alongside the map, the fans and the opportunities —
+    // so this running total can only ever be a LOWER bound on what the finalizer
+    // charges. That direction is what makes the early refusal safe: it can never
+    // reject a projection the finalizer would have accepted, and the finalizer
+    // stays the single authority on the answer the viewer is given.
+    let mut charged = 0usize;
     for host_id in filtered_state.objects.keys().copied() {
-        // Seeded with the host: an attachment cycle would otherwise walk
-        // forever, and no host may appear as a card beneath itself.
-        let mut seen = HashSet::from([host_id]);
         let mut cards = Vec::new();
-        collect_attachment_subtree(filtered_state, host_id, &mut seen, &mut cards);
-        if cards.len() > MAX_INTERACTION_LIST_LEN {
-            return Err(InteractionReasonCode::PayloadTooLarge);
-        }
+        collect_attachment_subtree(filtered_state, host_id, charged, &mut cards)?;
         if cards.is_empty() {
             continue;
         }
+        charged += cards.len();
         views.insert(
             host_id.0,
             InteractionAttachmentView {
@@ -7861,6 +7867,9 @@ fn attachment_views_for_viewer(
             },
         );
     }
+    // Implied by the card charge — no view is inserted empty, so the map can
+    // never be longer than the cards already counted — but stated where the map
+    // is built so its own list bound does not have to be inferred.
     if views.len() > MAX_INTERACTION_LIST_LEN {
         return Err(InteractionReasonCode::PayloadTooLarge);
     }
@@ -7869,28 +7878,57 @@ fn attachment_views_for_viewer(
 
 /// Depth-first pre-order, so a nested attachment follows the card it hangs on
 /// and consumers can lay the subtree out without re-deriving its shape.
+///
+/// Iterative, with the frontier on the heap. The walk descends one level per
+/// nested attachment, and an attachment chain is only bounded by how many
+/// objects the game can grow, so recursion would put a game-controlled quantity
+/// on the call stack.
+///
+/// `already_charged` is what earlier hosts have spent, and the walk stops the
+/// moment this subtree carries the running total past the aggregate. An
+/// over-budget projection therefore costs one card more than the budget rather
+/// than its full size: the point of deriving membership is to publish it, and a
+/// projection that can no longer be published is not worth materializing.
+///
+/// The running total is compared by addition rather than by handing the walk a
+/// remaining allowance, so the bound cannot be expressed as a subtraction that
+/// underflows if the caller's accounting ever slips.
 fn collect_attachment_subtree(
     filtered_state: &GameState,
     host_id: ObjectId,
-    seen: &mut HashSet<ObjectId>,
+    already_charged: usize,
     out: &mut Vec<ObjectId>,
-) {
-    let Some(host) = filtered_state.objects.get(&host_id) else {
-        return;
-    };
-    for child_id in &host.attachments {
-        let Some(child) = filtered_state.objects.get(child_id) else {
-            continue;
-        };
-        if !matches!(child.attached_to, Some(AttachTarget::Object(id)) if id == host_id) {
-            continue;
+) -> Result<(), InteractionReasonCode> {
+    // Seeded with the host: an attachment cycle would otherwise walk forever,
+    // and no host may appear as a card beneath itself.
+    let mut seen = HashSet::from([host_id]);
+    let mut frontier = vec![host_id];
+    while let Some(current) = frontier.pop() {
+        if current != host_id {
+            out.push(current);
+            if already_charged + out.len() > MAX_INTERACTION_LIST_LEN {
+                return Err(InteractionReasonCode::PayloadTooLarge);
+            }
         }
-        if !seen.insert(*child_id) {
+        let Some(object) = filtered_state.objects.get(&current) else {
             continue;
+        };
+        // Pushed in reverse so the frontier pops them in the order the host
+        // lists them, which is what keeps the output in pre-order.
+        for child_id in object.attachments.iter().rev() {
+            let Some(child) = filtered_state.objects.get(child_id) else {
+                continue;
+            };
+            if !matches!(child.attached_to, Some(AttachTarget::Object(id)) if id == current) {
+                continue;
+            }
+            if !seen.insert(*child_id) {
+                continue;
+            }
+            frontier.push(*child_id);
         }
-        out.push(*child_id);
-        collect_attachment_subtree(filtered_state, *child_id, seen, out);
     }
+    Ok(())
 }
 
 /// Bind the published picks onto the membership the engine already owns.
diff --git a/crates/engine/tests/integration/interaction_contract.rs b/crates/engine/tests/integration/interaction_contract.rs
index 9134cbc729..ff087760d3 100644
--- a/crates/engine/tests/integration/interaction_contract.rs
+++ b/crates/engine/tests/integration/interaction_contract.rs
@@ -801,9 +801,21 @@ fn an_oversized_attachment_tree_fails_closed_instead_of_publishing_an_empty_map(
 
 /// The nesting half of the same claim, read through the DERIVED path: every
 /// view is small, and it is the tree that is too large.
+///
+/// A chain is the shape where the derivation's own cost is quadratic — every
+/// ancestor carries the whole tail beneath it — so the row is also the one that
+/// says the budget is charged while membership is derived rather than after it.
+/// At this depth the finished payload would hold 499 500 cards; the derivation
+/// stops one card past the aggregate instead.
+///
+/// The depth is capped by what the derived path costs elsewhere, not by what the
+/// walk costs: enumerating every legal action over the chain is quadratic too,
+/// and measured on this fixture it runs 1 s at 1 000 links, 14 s at 3 000 and
+/// 109 s at 10 000. `a_cap_depth_attachment_chain_is_refused_before_it_is_built`
+/// carries the depth claim past that ceiling through the cheap seat.
 #[test]
 fn a_deep_attachment_chain_fails_closed_on_the_aggregate() {
-    const CHAIN: usize = 200;
+    const CHAIN: usize = 1_000;
     let mut scenario = GameScenario::new();
     scenario.at_phase(Phase::PreCombatMain);
     let root = scenario.add_creature(P0, "Chain Root", 2, 2).id();
@@ -831,6 +843,57 @@ fn a_deep_attachment_chain_fails_closed_on_the_aggregate() {
     assert!(deep.attachment_views.is_empty());
 }
 
+/// The depth half, at the worst depth there is: a chain exactly
+/// `MAX_INTERACTION_LIST_LEN` links long is the LONGEST one in which no single
+/// view exceeds the per-view cap, so it is precisely the shape a per-host check
+/// cannot catch. One link shorter and the aggregate is smaller; one longer and
+/// the outermost view trips the per-view cap on its own and the derivation stops
+/// at the first host. This is the depth the engine permits, too — CR 732.2's
+/// runaway-cascade guard (`MAX_OBJECT_GROWTH`, `game::engine`) lets one dispatch
+/// grow the board by 16 000 objects.
+///
+/// The finished payload here holds 49 995 000 cards, the prefix sums of every
+/// nested view. Measured on this fixture, deriving membership in full and
+/// measuring afterwards costs 23.2 s and peaks at 7.4 GB resident; charging the
+/// aggregate as the walk goes costs 0.16 s and 4.7 GB, which is the fixture
+/// itself. The engine ships to WASM, where that difference is linear-memory
+/// exhaustion rather than a slow frame.
+///
+/// The answer is the same either way — the finalizer always refused this payload
+/// — so the row asserts the answer and the cost above is what the change is for.
+/// Read through the unauthorized early return, which reaches the same membership
+/// derivation without the action enumeration the derived path owes over ten
+/// thousand permanents (109 s, measured); the row above carries the same
+/// fail-closed answer through the derived path at an affordable depth.
+#[test]
+fn a_cap_depth_attachment_chain_is_refused_before_it_is_built() {
+    const CHAIN: usize = MAX_INTERACTION_LIST_LEN;
+    let mut scenario = GameScenario::new();
+    scenario.at_phase(Phase::PreCombatMain);
+    let root = scenario.add_creature(P0, "Cap Depth Root", 2, 2).id();
+    let seed = scenario.add_creature(P0, "Cap Depth Link", 1, 1).id();
+    let mut runner = scenario.build();
+    {
+        let state = runner.state_mut();
+        attach_and_assert_linked(state, seed, root);
+        let mut next_id = next_object_id(state);
+        let mut tip = seed;
+        for _ in 1..CHAIN {
+            tip = clone_attachment_onto(state, seed, tip, &mut next_id);
+        }
+        bind(state, "attachment-view-cap-depth");
+    }
+    let deep = viewer_interaction(runner.state(), P1);
+    assert_eq!(
+        deep.availability,
+        InteractionAvailability::Unsupported {
+            reason: InteractionReasonCode::PayloadTooLarge,
+        },
+        "a chain {CHAIN} links deep is refused, not walked to the bottom"
+    );
+    assert!(deep.attachment_views.is_empty() && deep.opportunities.is_empty());
+}
+
 #[test]
 fn authority_requires_explicit_binding_and_rebinding_invalidates_old_capabilities() {
     let mut state = GameState::new_two_player(42);

From faf7de009b93f1f719dc5b2093bf2fffeebc2b74 Mon Sep 17 00:00:00 2001
From: cuinhellcat <217210902+cuinhellcat@users.noreply.github.com>
Date: Sat, 15 Aug 2026 12:58:19 +0200
Subject: [PATCH 6/8] test(engine): prove the membership derivation refuses
 before it builds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The public rows in `interaction_contract` cannot carry this claim. The
aggregate bound in `bound_outbound_view` already refused this payload, so
the ANSWER is `Unsupported { PayloadTooLarge }` with or without the
incremental charge; what the change moves is when the refusal happens.

`the_membership_derivation_refuses_a_worst_case_chain_before_building_it`
asserts on `attachment_views_for_viewer` itself. A chain of exactly
`MAX_INTERACTION_LIST_LEN` links is the only depth that discriminates: it
is the longest one in which no host's own subtree exceeds the per-view
cap, so a derivation that measures after materializing runs to completion.
One link longer and the outermost view trips that cap by itself.

Two reach guards run first — the fixture is exactly
`MAX_INTERACTION_LIST_LEN + 1` objects and no host carries more than one
attachment — so an over-long or fanned-out fixture cannot fail the row for
the wrong reason.

Counter-measured: with the running charge dropped and the post-walk
`cards.len()` check restored, it fails on `Ok`, holding 9 999 views and
49 995 000 cards. The assertion compares by discriminant and reports those
two SIZES rather than the value, because printing the rejected `Ok`
produced 3.2 GB of output for one failed assertion.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/engine/src/game/interaction.rs | 78 +++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)

diff --git a/crates/engine/src/game/interaction.rs b/crates/engine/src/game/interaction.rs
index 04ce780567..6e9e4d0c9f 100644
--- a/crates/engine/src/game/interaction.rs
+++ b/crates/engine/src/game/interaction.rs
@@ -9949,4 +9949,82 @@ mod tests {
             );
         }
     }
+
+    /// The derivation itself, not the projection it feeds.
+    ///
+    /// `attachment_views_for_viewer` is the authority that decides whether the
+    /// membership can be published at all, and the public rows in
+    /// `interaction_contract` cannot see the difference this change makes: the
+    /// aggregate bound in `bound_outbound_view` already refused this payload, so
+    /// the ANSWER was fail-closed before and after. What changes is that the
+    /// refusal now happens while the projection is small.
+    ///
+    /// A chain of exactly `MAX_INTERACTION_LIST_LEN` links is the worst case and
+    /// the only one that discriminates: it is the LONGEST chain in which no
+    /// single host's subtree exceeds the per-view cap, so the per-host check
+    /// never fires and a derivation that measures afterwards runs to completion.
+    /// One link longer and the outermost view trips that cap on its own.
+    ///
+    /// REVERT-PROBE, RUN: drop the running charge in `collect_attachment_subtree`
+    /// and restore the post-walk `cards.len()` check ⇒ this returns `Ok` with
+    /// 49 995 000 card entries across 9 999 views (23.2 s, 7.4 GB resident on the
+    /// machine this was measured on) instead of `Err`.
+    #[test]
+    fn the_membership_derivation_refuses_a_worst_case_chain_before_building_it() {
+        use crate::game::game_object::GameObject;
+        use crate::types::identifiers::CardId;
+
+        let mut state = GameState::new_two_player(42);
+        let owner = PlayerId(0);
+        let mut previous: Option<ObjectId> = None;
+        for index in 0..=MAX_INTERACTION_LIST_LEN {
+            let id = ObjectId(index as u64 + 1);
+            let mut object = GameObject::new(
+                id,
+                CardId(index as u64 + 1),
+                owner,
+                format!("Chain Link {index}"),
+                Zone::Battlefield,
+            );
+            if let Some(host_id) = previous {
+                object.attached_to = Some(AttachTarget::Object(host_id));
+                state
+                    .objects
+                    .get_mut(&host_id)
+                    .expect("the host was inserted on the previous iteration")
+                    .attachments
+                    .push(id);
+            }
+            state.objects.insert(id, object);
+            state.battlefield.push_back(id);
+            previous = Some(id);
+        }
+
+        // Reach guard: the fixture really is one chain of the intended length,
+        // and every view in it would sit inside the per-view cap on its own —
+        // without this, an over-long fixture would fail for the wrong reason.
+        assert_eq!(state.objects.len(), MAX_INTERACTION_LIST_LEN + 1);
+        assert!(
+            state
+                .objects
+                .values()
+                .all(|object| object.attachments.len() <= 1),
+            "a chain, not a fan: no host may carry two attachments"
+        );
+
+        // Compared by discriminant, and reported by SIZE rather than by value:
+        // the `Ok` this row exists to reject holds 49 995 000 entries, and a
+        // failure that prints them is a failure nobody can read.
+        let derived = attachment_views_for_viewer(&state);
+        assert!(
+            matches!(derived, Err(InteractionReasonCode::PayloadTooLarge)),
+            "the derivation must refuse the payload itself rather than hand it to \
+             the finalizer to reject — got {} views totalling {} cards",
+            derived.as_ref().map_or(0, BTreeMap::len),
+            derived.as_ref().map_or(0, |views| views
+                .values()
+                .map(|view| view.cards.len())
+                .sum::<usize>()),
+        );
+    }
 }

From 3f5e68d72bd4432380afc2e716b16fcc11547216 Mon Sep 17 00:00:00 2001
From: matthewevans <matthewevans@users.noreply.github.com>
Date: Sat, 15 Aug 2026 05:06:40 -0700
Subject: [PATCH 7/8] test(PR-7296): cover projected attachment badge count

Co-authored-by: cuinhellcat <217210902+cuinhellcat@users.noreply.github.com>
---
 .../board/__tests__/PermanentCard.test.tsx    | 34 +++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/client/src/components/board/__tests__/PermanentCard.test.tsx b/client/src/components/board/__tests__/PermanentCard.test.tsx
index 977cd68402..1e0422e069 100644
--- a/client/src/components/board/__tests__/PermanentCard.test.tsx
+++ b/client/src/components/board/__tests__/PermanentCard.test.tsx
@@ -682,6 +682,40 @@ describe("PermanentCard", () => {
     expect(useUiStore.getState().inspectedObjectId).toBeNull();
   });
 
+  it("labels the fan control from the projected card count rather than raw attachments", () => {
+    const gameState = makeState();
+    gameState.objects[1].attachments = [2, 4];
+    gameState.objects[4] = makeObject({
+      id: 4,
+      card_id: 400,
+      attached_to: { type: "Object", data: 1 },
+      attachments: [],
+      name: "Second Equipment",
+      power: null,
+      toughness: null,
+      base_power: null,
+      base_toughness: null,
+      card_types: { supertypes: [], core_types: ["Artifact"], subtypes: ["Equipment"] },
+      color: [],
+      base_color: [],
+    });
+    gameState.battlefield = [1, 2, 3, 4];
+    useGameStore.setState({
+      gameState,
+      waitingFor: gameState.waiting_for,
+      viewerInteraction: membershipOnly([2]),
+    });
+    act(() => {
+      useUiStore.setState({ selectedObjectId: 1 });
+    });
+
+    renderPermanent();
+
+    expect(screen.getByRole("button", {
+      name: "View Test Creature's 1 attached card",
+    })).toBeInTheDocument();
+  });
+
   it("keeps the single-attachment control readable at compact card sizes", () => {
     renderPermanent();
 

From 9bc3e4b1148a27d68fa6d1305d0cfb3db7a39c2a Mon Sep 17 00:00:00 2001
From: matthewevans <matthewevans@users.noreply.github.com>
Date: Sat, 15 Aug 2026 06:07:33 -0700
Subject: [PATCH 8/8] test(PR-7296): correct singular attachment label
 assertion

Co-authored-by: cuinhellcat <217210902+cuinhellcat@users.noreply.github.com>
---
 client/src/components/board/__tests__/PermanentCard.test.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/components/board/__tests__/PermanentCard.test.tsx b/client/src/components/board/__tests__/PermanentCard.test.tsx
index 1e0422e069..ef0eeae578 100644
--- a/client/src/components/board/__tests__/PermanentCard.test.tsx
+++ b/client/src/components/board/__tests__/PermanentCard.test.tsx
@@ -712,7 +712,7 @@ describe("PermanentCard", () => {
     renderPermanent();
 
     expect(screen.getByRole("button", {
-      name: "View Test Creature's 1 attached card",
+      name: "View Test Creature's attached card",
     })).toBeInTheDocument();
   });