fix(engine): give the Cipher encode offer a frame instead of clobbering the live prompt (#7470)

crates/engine/src/game/cipher.rs

@@ -127,27 +127,151 @@ pub(crate) fn finish_encode(
 }
 
 /// CR 702.99a: Begin the on-resolution encode offer for a Cipher spell. Returns
-/// `true` when resolution paused for the choice (the caller must stop finalizing
-/// the spell and return, leaving the card held off the stack like a mutating
-/// spell), or `false` when there is no encode to offer — the spell isn't an
-/// encodable cipher card, or the controller has no creature to host it — so the
-/// caller routes the card normally (to its owner's graveyard).
-pub fn begin_encode_choice(state: &mut GameState, card_id: ObjectId, controller: PlayerId) -> bool {
+/// `true` when this hook has taken the card off the caller's hands — normally
+/// because resolution paused for the choice (the caller stops finalizing the
+/// spell and returns, leaving the card held off the stack like a mutating
+/// spell), and in the one degenerate case below because the offer already
+/// completed as a decline and routed the card itself. Returns `false` when there
+/// is no encode to offer at all — the spell isn't an encodable cipher card, or
+/// the controller has no creature to host it — so the caller routes the card
+/// normally (to its owner's graveyard).
+///
+/// Both `true` arms leave the caller with nothing to route, which is what makes
+/// them one answer: the distinction that matters to a caller is whether the card
+/// is still its responsibility.
+pub fn begin_encode_choice(
+    state: &mut GameState,
+    card_id: ObjectId,
+    controller: PlayerId,
+    events: &mut Vec<GameEvent>,
+) -> bool {
     if !spell_can_encode(state, card_id) {
         return false;
     }
     let creatures = legal_encode_creatures(state, controller);
     if creatures.is_empty() {
         return false;
     }
-    state.waiting_for = WaitingFor::CipherEncodeChoice {
-        player: controller,
+    let pending = crate::types::resolution::PendingCipherEncode {
+        stage: crate::types::resolution::CipherEncodeStage::Parked,
         card_id,
+        controller,
         creatures,
     };
+
+    // CR 702.99a: the encode is the spell's LAST instruction. When the spell's
+    // own effects are still paused on a player answer, this offer must not
+    // overwrite that live prompt (issue #7470) — it is parked BELOW the frame
+    // that owns the prompt and armed by `resume_resolution_frames` once that
+    // owner is consumed. Either way the caller's contract is the same: the
+    // resolution owes an answer, so the card is held off the stack.
+    park_encode_offer(state, pending, events);
     true
 }
 
+/// Park the encode offer, arming it immediately only when nothing else owns the
+/// current prompt.
+///
+/// The offer always leaves this function accounted for: armed as the live
+/// prompt, parked as a frame that will arm later, or — if the stack refuses a
+/// prompt-less frame at all — completed as a decline. It is never dropped.
+fn park_encode_offer(
+    state: &mut GameState,
+    pending: crate::types::resolution::PendingCipherEncode,
+    events: &mut Vec<GameEvent>,
+) {
+    // The question is not what SHAPE the top frame has — it is whether the
+    // resolution is currently asking the player anything at all. Keying this to
+    // `FrameGate::DirectChoice` missed the discard pause (Mental Vapors), whose
+    // frame owns a prompt without being a direct-choice owner. `waiting_for`
+    // is the engine's single answer to "is a question open", so ask it.
+    let resolution_paused = !matches!(state.waiting_for, WaitingFor::Priority { .. });
+    if !resolution_paused {
+        let (player, card_id, creatures) = (
+            pending.controller,
+            pending.card_id,
+            pending.creatures.clone(),
+        );
+        // The frame and the prompt it may consume are installed as one step:
+        // a direct-choice owner that is visible with an unrelated `WaitingFor`
+        // is the very state #7470 left behind, and this authority makes the two
+        // unable to disagree.
+        let armed = crate::types::resolution::ResolutionFrame::CipherEncode(
+            crate::types::resolution::PendingCipherEncode {
+                stage: crate::types::resolution::CipherEncodeStage::Armed,
+                ..pending
+            },
+        );
+        if state
+            .install_direct_choice_frame(
+                armed,
+                WaitingFor::CipherEncodeChoice {
+                    player,
+                    card_id,
+                    creatures,
+                },
+            )
+            .is_err()
+        {
+            // Same reasoning as the parked branch below: a refusal means the
+            // stack was already invalid, and the card still has to leave
+            // resolution by a legal route, so the offer completes as a decline
+            // (CR 608.2n) rather than being dropped.
+            handle_encode_choice(state, card_id, None, events);
+        }
+        return;
+    }
+    // Where a prompt-less frame may sit is a property of the stack's shape, not
+    // a guess this caller gets to make: an empty stack (a discard prompt owns no
+    // frame), the ordinary position below the active child, or outside a paused
+    // post-replacement/draw pair whose adjacency `validate` protects. The stack
+    // answers that itself, so no legal shape can refuse the offer.
+    let card_id = pending.card_id;
+    if state
+        .park_cipher_encode_beneath_live_prompt(pending)
+        .is_err()
+    {
+        // The stack rejected a frame that owns no prompt, which means it was
+        // already invalid before this offer existed. The card must still leave
+        // resolution by one of its two legal routes, so complete the offer the
+        // way a declined one completes (CR 608.2n: the card goes to its owner's
+        // graveyard) instead of dropping it and stranding the card off the
+        // stack. The live prompt is untouched either way — a decline moves a
+        // card, it does not ask a question.
+        handle_encode_choice(state, card_id, None, events);
+    }
+}
+
+/// CR 702.99a: Arm a parked encode offer once it reaches the stack top, i.e.
+/// after the spell's own effects have finished. Called from the exhaustive
+/// frame-resume dispatch, which is what guarantees a parked offer is never
+/// forgotten.
+pub(crate) fn arm_parked_encode_offer(state: &mut GameState, events: &mut Vec<GameEvent>) {
+    let Some(pending) = state.resolution_stack.active_cipher_encode() else {
+        return;
+    };
+    // CR 702.99a: re-read legal hosts — the spell's own effects ran since the
+    // offer was parked and may have changed the board.
+    let creatures = legal_encode_creatures(state, pending.controller);
+    let (player, card_id) = (pending.controller, pending.card_id);
+    if creatures.is_empty() {
+        // No legal host left: consume the frame and route the card the way a
+        // declined offer does (CR 608.2n).
+        let _ = state.take_active_cipher_encode_frame();
+        handle_encode_choice(state, card_id, None, events);
+        return;
+    }
+    if let Some(frame) = state.resolution_stack.active_cipher_encode_mut() {
+        frame.stage = crate::types::resolution::CipherEncodeStage::Armed;
+        frame.creatures = creatures.clone();
+    }
+    state.waiting_for = WaitingFor::CipherEncodeChoice {
+        player,
+        card_id,
+        creatures,
+    };
+}
+
 /// CR 702.99a–b: Resolve the encode choice. `creature = Some(id)` encodes the
 /// card on that creature (exile + link); `None` — or a creature that is no
 /// longer a legal host — declines, routing the card to its owner's graveyard

crates/engine/src/game/cipher_tests.rs

@@ -13,6 +13,7 @@ use crate::types::game_state::{GameState, WaitingFor};
 use crate::types::identifiers::{CardId, ObjectId};
 use crate::types::keywords::Keyword;
 use crate::types::player::PlayerId;
+use crate::types::resolution::{CipherEncodeStage, PendingCipherEncode, ResolutionFrame};
 use crate::types::zones::Zone;
 
 fn creature(state: &mut GameState, card: u64, owner: PlayerId, name: &str, zone: Zone) -> ObjectId {
@@ -189,7 +190,12 @@ fn begin_encode_choice_pauses_then_accept_encodes() {
     let host = creature(&mut state, 1, PlayerId(0), "Host", Zone::Battlefield);
     let spell = cipher_spell(&mut state, 2, PlayerId(0));
 
-    assert!(begin_encode_choice(&mut state, spell, PlayerId(0)));
+    assert!(begin_encode_choice(
+        &mut state,
+        spell,
+        PlayerId(0),
+        &mut Vec::new(),
+    ));
     match &state.waiting_for {
         WaitingFor::CipherEncodeChoice {
             player,
@@ -214,7 +220,12 @@ fn begin_encode_choice_pauses_then_accept_encodes() {
 fn begin_encode_choice_skipped_without_host() {
     let mut state = GameState::new_two_player(1);
     let spell = cipher_spell(&mut state, 1, PlayerId(0));
-    assert!(!begin_encode_choice(&mut state, spell, PlayerId(0)));
+    assert!(!begin_encode_choice(
+        &mut state,
+        spell,
+        PlayerId(0),
+        &mut Vec::new(),
+    ));
 }
 
 /// CR 608.2n: declining the encode puts the card into its owner's graveyard.
@@ -223,13 +234,62 @@ fn handle_encode_choice_decline_routes_to_graveyard() {
     let mut state = GameState::new_two_player(1);
     let _host = creature(&mut state, 1, PlayerId(0), "Host", Zone::Battlefield);
     let spell = cipher_spell(&mut state, 2, PlayerId(0));
-    assert!(begin_encode_choice(&mut state, spell, PlayerId(0)));
+    assert!(begin_encode_choice(
+        &mut state,
+        spell,
+        PlayerId(0),
+        &mut Vec::new(),
+    ));
 
     handle_encode_choice(&mut state, spell, None, &mut Vec::new());
     assert_eq!(state.objects[&spell].zone, Zone::Graveyard);
     assert!(state.exile_links.is_empty());
 }
 
+/// CR 702.99a + CR 608.2n: A host that left while the spell's own prompt was
+/// resolving leaves a parked offer with no legal target. The production resume
+/// dispatcher must decline the card through its caller's event buffer, so the
+/// zone move remains visible to the normal trigger pipeline.
+#[test]
+fn host_loss_before_arming_emits_the_decline_zone_change() {
+    let mut state = GameState::new_two_player(1);
+    let host = creature(&mut state, 1, PlayerId(0), "Host", Zone::Battlefield);
+    let spell = cipher_spell(&mut state, 2, PlayerId(0));
+    state
+        .resolution_stack
+        .push_inner(ResolutionFrame::CipherEncode(PendingCipherEncode {
+            stage: CipherEncodeStage::Parked,
+            card_id: spell,
+            controller: PlayerId(0),
+            creatures: vec![host],
+        }));
+
+    // This is the interleaving the parked frame represents: the host was legal
+    // when the offer parked, then the spell's remaining work removed it before
+    // `resume_resolution_frames` could arm the offer.
+    super::zones::move_to_zone(&mut state, host, Zone::Graveyard, &mut Vec::new());
+
+    let mut events = Vec::new();
+    super::effects::resume_resolution_frames(&mut state, &mut events);
+
+    assert!(state.resolution_stack.is_empty());
+    assert_eq!(state.objects[&spell].zone, Zone::Graveyard);
+    assert!(
+        events.iter().any(|event| {
+            matches!(
+                event,
+                GameEvent::ZoneChanged {
+                    object_id,
+                    from: Some(Zone::Stack),
+                    to: Zone::Graveyard,
+                    ..
+                } if *object_id == spell
+            )
+        }),
+        "the production resume path must publish the declined cipher card's zone move"
+    );
+}
+
 // ── Combat-damage recast ──────────────────────────────────────────────────
 
 /// CR 702.99c: an encoded creature dealing combat damage to a player produces

crates/engine/src/game/effects/mod.rs

@@ -988,6 +988,12 @@ pub(crate) fn resume_resolution_frames(state: &mut GameState, events: &mut Vec<G
             drain_pending_continuation(state, events)
         }
         ResolutionFrame::Discard(_) => {}
+        // CR 702.99a: a Cipher encode offer parked under the spell's own prompt
+        // arms here — i.e. only once that prompt's owner is consumed, which is
+        // what puts the encode after the spell's other effects (issue #7470).
+        ResolutionFrame::CipherEncode(_) => {
+            crate::game::cipher::arm_parked_encode_offer(state, events);
+        }
         ResolutionFrame::RepeatFor(_) => drain_active_repeat_for(state, events),
         ResolutionFrame::RepeatUntil(_) => drain_active_repeat_until(state),
         ResolutionFrame::RepeatedOptionalPayment(_) => {

crates/engine/src/game/engine.rs

@@ -19301,9 +19301,12 @@ mod stage2_injector_tests {
                 // all MATCH). The round's other edits are the two new `#[cfg(test)]`
                 // tests, which are below all three and mint no prompt, so the `in_test`
                 // total is unchanged.
-                "game/effects/mod.rs:7261".to_string(),
-                "game/effects/mod.rs:7338".to_string(),
-                "game/effects/mod.rs:10618".to_string(),
+                // #7496's parked Cipher frame extends the exhaustive resume dispatch above
+                // all three producers. It adds six lines without assigning an optional-effect
+                // prompt, so the measured production producers move uniformly by `+6`.
+                "game/effects/mod.rs:7267".to_string(),
+                "game/effects/mod.rs:7344".to_string(),
+                "game/effects/mod.rs:10624".to_string(),
                 // UNMOVED across the rebase, and that is itself evidence the SET did not
                 // move: a census that had gained or lost a producer would not leave this
                 // entry both byte-identical AND at the same coordinate.

crates/engine/src/game/engine_resolution_choices.rs

@@ -6675,6 +6675,21 @@ pub(super) fn handle_resolution_choice(
             // of clobbering it with `Priority`; otherwise resolution is complete,
             // so return to priority and let the resulting zone change's triggers /
             // SBAs process.
+            // CR 702.99a: the offer's own frame owns this prompt (issue #7470),
+            // so consume it BEFORE the card moves — the encode's zone change can
+            // park frames of its own, and a stale owner underneath them would
+            // fail `validate` at the next prompt. This holds for BOTH answers:
+            // a decline (`creature: None`) ends the offer just as an acceptance
+            // does, so it must consume the owner just as an acceptance does.
+            //
+            // The error is surfaced rather than swallowed: it means some other
+            // frame is sitting on top of this prompt's owner, which is the exact
+            // corruption this frame was introduced to make impossible. `Ok(None)`
+            // is not that — it is an empty stack, i.e. no owner to leave stale,
+            // which is what a game saved before this frame existed restores as.
+            state
+                .take_active_cipher_encode_frame()
+                .map_err(|error| EngineError::InvalidAction(error.to_string()))?;
             match crate::game::cipher::handle_encode_choice(state, card_id, creature, events) {
                 crate::game::zone_pipeline::ZoneMoveResult::Done => {
                     ResolutionChoiceOutcome::WaitingFor(WaitingFor::Priority {

crates/engine/src/game/stack.rs

@@ -1525,7 +1525,7 @@ pub fn resolve_top(state: &mut GameState, events: &mut Vec<GameEvent>) {
     // exiles+encodes on accept, or routes the card to its graveyard on decline.
     // Skipped (resolution proceeds to graveyard normally) when there is no legal
     // host. `is_spell` gates out triggered/activated stack entries.
-    if is_spell && super::cipher::begin_encode_choice(state, entry.id, entry.controller) {
+    if is_spell && super::cipher::begin_encode_choice(state, entry.id, entry.controller, events) {
         events.push(GameEvent::StackResolved {
             object_id: entry.id,
         });

crates/engine/src/types/game_state.rs

@@ -19476,6 +19476,44 @@ impl GameState {
         self.resolution_stack.push_mutate_merge(pending);
     }
 
+    /// CR 702.99a: Park a Cipher encode offer as the active prompt owner.
+    pub fn push_cipher_encode_frame(&mut self, pending: super::resolution::PendingCipherEncode) {
+        self.resolution_stack.push_cipher_encode(pending);
+    }
+
+    /// CR 702.99a: Park a Cipher encode offer beneath the frame that owns the
+    /// spell's own prompt, so the encode arms only after that owner is
+    /// consumed.
+    ///
+    /// The position is the stack's decision, not this caller's: a parked offer
+    /// owns no prompt while `Parked`, and where such a frame may sit is a
+    /// property of the stack's current shape — see
+    /// [`ParkedFramePlacement`](super::resolution::ParkedFramePlacement). This
+    /// deliberately does NOT go through `InsertParentOfActive`: inserting below
+    /// the top is a structural guess that lands inside a paused
+    /// post-replacement/draw pair, and by the time the resulting `Err` came
+    /// back the caller had already retained its card off the normal resolution
+    /// route.
+    pub fn park_cipher_encode_beneath_live_prompt(
+        &mut self,
+        pending: super::resolution::PendingCipherEncode,
+    ) -> Result<(), ResolutionStackError> {
+        self.resolve_and_apply_frame_transition(ResolvedFrameTransition::ParkBeneathLivePrompt {
+            frame: super::resolution::ResolutionFrame::CipherEncode(pending),
+        })
+        .map(|_| ())
+        .map_err(|error| match error {
+            ResolvedFrameTransitionReplayInvariantError::Stack(error) => error,
+        })
+    }
+
+    /// CR 702.99a: Consume the active Cipher encode offer once answered.
+    pub fn take_active_cipher_encode_frame(
+        &mut self,
+    ) -> Result<Option<super::resolution::PendingCipherEncode>, ResolutionStackError> {
+        self.resolution_stack.take_active_cipher_encode()
+    }
+
     /// Re-parks the active mutate-merge owner without exposing an empty-stack
     /// interval.
     pub fn replace_active_mutate_merge_frame(
@@ -20322,6 +20360,9 @@ impl GameState {
             ResolvedFrameTransition::InsertParentOfActive { frame } => {
                 resolution_stack.insert_parent_of_active(frame.clone())?;
             }
+            ResolvedFrameTransition::ParkBeneathLivePrompt { frame } => {
+                let _ = resolution_stack.park_beneath_live_prompt(frame.clone());
+            }
             ResolvedFrameTransition::PopExpected { kind } => {
                 let _ = resolution_stack.pop_expected(*kind)?;
             }