fix(engine): escalate entry-incremental flush when an entrant's card types are rewritten - #6846

…try-flush gate

CR 613.1e.

The entry-incremental flush escalates to a full re-evaluation when an
entering permanent could move a counted population. It recognised two ways
that happens -- a layer-4 card-type rewrite (CR 613.1d) and a layer-2
control change (CR 613.1b) -- and deliberately did not recognise a third.
A layer-5 color-changing effect (CR 613.1e) rewrites the very characteristic
a color-keyed population reads, and layer 5 runs before the layer-7 count,
so the pre-layer probe saw the entrant's printed color rather than its
derived one.

That gap shipped as a knowingly-passing tripwire test asserting the stale
board. It should not have. A test that passes while codifying stale derived
state is an active layer-ordering error, not a baseline: the fixture's
pre-existing Bears sat at 4/4 where a full pass correctly derives 5/5, and
nothing in CI would have gone red if that divergence had widened.

`modification_population_key_write` gains a `Color` variant and classifies
`SetColor`, `AddColor` and `AddChosenColor` into it. The match stays
exhaustive and wildcard-free over all `ContinuousModification` variants, so
a future key-rewriting variant still cannot be added without deciding this
question at compile time. Parameterizing here rather than adding a sibling
classifier keeps the axis inside CR 613: all three keys are written by
layers of the same rule section.

`known_gap_color_keyed_population_probes_entrant_pre_layer` is replaced by
`color_change_entry_escalates_when_population_is_color_keyed`, which requires
escalation and full normal-vs-forced board identity instead of pinning the
divergence. It discriminates in both directions: revert the classifier's
`Color` arm and the escalation assertion fails at stack.rs:10292 with
"a layer-5 color wash reaching the entrant moves a color-keyed count";
keep the arm but break the escalation plumbing and the identity assertion
fails on the Bears' derived power/toughness.

The fast path is unaffected. The gate still requires a classified writer to
REACH an entrant AND a live population read to exist, so the two boards
pinned as fast paths -- whose only effects write P/T -- keep taking the
incremental arm: `count_anthem_nonmatching_entry_does_not_escalate_and_matches_full`
and `devotion_gate_colorless_entry_does_not_escalate_and_matches_full` both
still pass, along with the other 31 escalation fixtures.

KEYWORD, NAME and P/T remain open as the same shape and are still documented
as such; closing them needs the full FilterProp-reads x
ContinuousModification-writes matrix rather than another per-key arm.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…ind relation

CR 613.1b / CR 613.1c / CR 613.1d / CR 613.1e / CR 613.1f / CR 613.1g / CR 613.6.

The escalation gate had a one-sided writer list. `PopulationKeyWrite` enumerated the
two characteristics an entering permanent could have rewritten -- card types and
controller -- and any recognized write escalated whenever anything on the board
read an object population at all. Keyword, name, colour and P/T rewrites were
missing from that list, and the review is right that adding them to it would not
have been the fix: the read side was untyped, so widening the writer list widens
every board, and the two deliberately pinned fast paths
(`count_anthem_nonmatching_entry_does_not_escalate_and_matches_full`,
`devotion_gate_colorless_entry_does_not_escalate_and_matches_full`) would have
started escalating. That is why the P/T channel could not be closed by extending
the enum, and it is what made the sibling cluster the wrong shape to grow.

Both sides are now typed and the gate is their intersection.
`CharacteristicKinds` is a bitmask over seven kinds, one per CR 613 sublayer that
can be written -- Controller (613.1b), NameText (613.1c, with 612.8 for name-setting
as a text-changing effect), CardTypes (613.1d), Color (613.1e), Abilities (613.1f),
PowerToughness (613.1g) -- plus ManaCost, which has no layer of its own but is
copy-writable under 707.9b and is read by devotion, so a copy effect has to be able
to move a devotion-keyed population. The parameterisation axis stays inside CR 613's
own taxonomy; subtypes and supertypes fold into CardTypes because 613.1d is one
sublayer.

`modification_characteristic_writes` maps all 57 `ContinuousModification` variants
to what they write; `target_filter_characteristic_reads` maps all 98 `FilterProp`
variants, and sibling walkers cover `QuantityRef` and `StaticCondition`, to what
they read. Every one is exhaustive and wildcard-free, so a new variant on either
enum fails to compile until somebody classifies it -- the property the previous
classifier had, kept on both surfaces instead of one. Uncertain forms map to the
full set, so a classification error can only over-escalate.

The read set is the union of three things and is built unconditionally: dynamic
magnitudes, live conditions, and every live modification's affected filter. The
affected-filter term is not optional. A board with no counting and no conditions at
all -- a layer-3 rename plus a static whose affected set keys on names -- has an
empty read set without it, so nothing intersects, and a pre-existing permanent whose
membership the rename flips keeps stale P/T. That is the same blindness this gate
exists to close, reached through a different door.

CR 613.6 carves out one shape. It fixes a continuous effect's set of affected objects
the first time the effect applies and retains it for the rest of the pass, so an
effect cannot push an object out of the filter that admitted it. A static that reads
a kind through its own affected filter and writes that kind through its own
modification -- "artifacts that aren't creatures become creatures" reads and writes
card types -- is therefore not a staleness risk against itself, and
`incremental_entry_retains_multi_layer_effect_affected_set` is the board that proves
it. The exclusion is keyed on the CR 613.6 retention group, not on the individual
modification: one `StaticDefinition` spawns sibling effects that each carry a clone
of the same affected filter, so excluding only the modification's own copy leaves
the clones contributing the same kind. A kind read by two distinct groups survives
any single exclusion, and an effect with no retention identity fails closed.

The gate is cheapest-first and entrant-independent for as long as possible: the
union of all write kinds is pure enum matches; the read set is computed once per
flush with an early exit once it saturates; a global disjointness check exits before
any affected filter is matched against any entrant. The scute-storm board leaves at
that check -- keyword grants write abilities, the board reads card types and
controller -- with zero `matches_target_filter` calls, which is stricter than the
ordering it replaces rather than looser.

Both fast paths still take the incremental arm, and they do it by typing rather than
by exemption: their anthems write P/T while their boards read card types, controller
and mana cost. The gate is now narrower in places as well as wider -- a control
change against a purely P/T-keyed population no longer escalates -- and both
directions are pinned.

Eight fixtures cover the channels: keyword, P/T, name, the cross-group
affected-filter channel, a condition reading through its own filter, and three
negatives for disjoint reads, controller-vs-P/T, and the CR 613.6 self-exclusion.
Each one was checked by reverting the specific classifier row or union term it
depends on and confirming it fails with a concrete stale value, then restoring it.
The P/T fixture puts the entrant under the opposing player so the toughness setter
is the only writer that reaches it -- with P/T as one kind, a P/T-keyed count anthem
that also reached the entrant would have satisfied the relation on its own and the
fixture would have passed with the fix removed.

The remaining-gap block is deleted because the matrix is what it asked for. What is
left is stated conservatism, not blindness. One boundary is inherited unchanged and
is now written down at the gate: the reach probe evaluates affected filters against
the previous final state while full evaluation matches them at intermediate layer
states, so a count-thresholded affected filter can diverge from the probe in either
direction. Typing the relation neither narrows nor widens that.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CR 102.1 + CR 102.3 / CR 805.4a.

`StaticCondition::DuringOpponentsTurn` landed on main after this branch was
cut. `static_condition_characteristic_reads_at` is exhaustive and wildcard-free,
so merging main in did not compile until the variant was classified. That is
the tripwire behaving as designed rather than an incident -- the property the
matrix exists to hold is precisely that a new condition cannot enter the tree
unclassified.

It joins the `DuringYourTurn` arm. Both consult the active player (CR 102.1),
and neither consults a layer-writable characteristic of any object. The two are
deliberately distinct conditions rather than one being `Not` of the other --
in a team game a teammate can be the active player while the controller's team
still holds the turn (CR 102.3 + CR 805.4a) -- but that distinction is invisible
to this classifier, which asks only which characteristics a condition reads.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

`check-parser-combinators.sh` flags `entrant.keywords.contains(..)` as a raw
keyword query that bypasses the authorities in `game/keywords.rs`: a raw
`contains` compares whole values, so it misses parameterised keywords whose
payload differs, and it never consults off-zone grants. The non-vacuity
assertion in
`keyword_grant_entry_stays_incremental_when_population_reads_are_disjoint` now
goes through `GameObject::has_keyword`, which matches on discriminant and is
the form already used elsewhere in this file.

The gate caught this in CI rather than locally because its base defaults to
`git merge-base origin/main HEAD` (scripts/check-parser-combinators.sh:48) and
this checkout names the upstream remote `upstream`, so the merge-base lookup
failed and it fell back to `HEAD~1` -- one commit of the branch instead of the
whole PR diff. Re-run against `upstream/main` explicitly it is `Gate A PASS
head=a0b60dcf base=96e41b3ab`, and this was the only violation in the branch.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…ous effects

`live_characteristic_reads` unioned characteristic kinds from printed and
granted-inner static definitions' conditions, but skipped the `condition` a
`TransientContinuousEffect` retains after resolution. CR 611.2c locks in a
resolved effect's affected SET; it does not lock in the gate, so a retained
condition is re-evaluated every pass exactly like the "isn't locked in"
static-ability effect of CR 611.3a. With the condition invisible to the read
set, an entry-incremental flush that rewrote an entrant's card types could not
see that the rewrite perturbed the gate, and recipients kept a stale board.

Union `e.condition` for every live `ActiveContinuousEffect` unconditionally,
alongside the existing global and affected-filter channels: the gate decides
WHETHER the effect applies at all, so it is a board-level read, not a
per-modification one (CR 613.6).

Also fixes four `characteristic_read_classification` misclassifications in
`filter.rs`. `FilterProp::Owned` mapped to `CharacteristicKinds::EMPTY` on the
reasoning that ownership is immutable (CR 108.3), but the prop is a two-operand
comparison whose LEFT operand is the live controller reference (CR 109.5), which
layer 2 can rewrite (CR 613.1b). Same shape for `Unpaired` (CR 702.95e),
`ControlledContinuouslySinceTurnBegan`, and `HasHasteOrControlledSinceTurnBegan`
(CR 302.6 + CR 702.10).

Two CodeRabbit findings: `FilterProp::DistinctFrom` was matched by a `_ =>`
wildcard inside a classifier documented as exhaustive and wildcard-free — it is
now an explicit arm — and a stale fixture name in a `stack.rs` doc comment now
points at `controller_keyed_count_anthem_with_control_theft_board`.

Tests exercise the building blocks, not the cards: four classifier-invariant
tests in `filter.rs` (including a roster guard that fails when a new
`ControllerRef`-carrying prop is added without classifying it), and one
entry-incremental fixture in `stack.rs` that installs a conditioned transient
through the single construction authority
`GameState::add_transient_continuous_effect`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

`any_active_static_condition_perturbed_by_entry` walked only
`obj.static_definitions.iter_all()` — printed and granted-inner CONTINUOUS
`StaticDefinition`s — so a source-level enabling condition riding on a
`TransientContinuousEffect` was invisible to the entry-perturbation probe.

CR 611.2c locks in a resolved effect's affected SET, not its gate. A retained
condition therefore flips on entry exactly like a printed one (CR 611.3a), and
every recipient frozen into that effect's set goes stale with it. Walk
`state.transient_continuous_effects` as a second generator channel, reading
`tce.condition` through the same population classifier and entry-narrowing probe
as the printed walk.

The transient walk deliberately has no truth-delta stage: `static_gate_truth` is
keyed by `StaticGateKey { source, def_index }` over printed definitions, and a
transient has no `def_index` in that key space (several transients can share one
`source_id`). Escalating on perturbation alone is the direction the whole gate is
built on, and matches the existing recipient-context arm, which also escalates
with no cache consult.

`FilterContext` is built with `tce.controller`, not the source object's current
controller: CR 109.5 gives a resolved spell or ability its controller for the
effect's whole existence, so "you" in the retained gate names the resolver — the
rebind-to-current-controller reading is only correct for static abilities.

The fixture installs a source-level `IsPresent{creature an opponent controls}`
gate through `GameState::add_transient_continuous_effect`, the single
construction authority, and reaches the probe on the disjunct that only this
walk can satisfy: nothing on the board writes the kinds the gate reads, so the
kind relation exits at stage 3 without it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

`live_characteristic_reads` unioned enabling conditions off `active_effects`,
which is a projection that structurally drops the two gate shapes an entry can
flip. `gather_transient_continuous_effects` skips a transient whose gate is
currently OFF (and an OFF gate is exactly the one an entry turns ON), and it
retains only a recipient-context condition — a source-level condition is
stripped from the effect it pushes. A `Duration::ForAsLongAs` condition
(CR 611.2b, Master Thief) reaches no `ActiveContinuousEffect` at all, because
no gather copies a duration onto one. So a board whose only live read of a
characteristic kind sat in one of those gates computed a `ReadKinds` missing
that kind, the kind relation exited early, the entry stayed incremental, and
every frozen recipient kept a stale board.

Walk `state.transient_continuous_effects` directly as a fifth read channel,
through a new `transient_gate_conditions` single authority that yields both
gates `transient_effect_is_live` consults: the "for as long as" duration
(CR 611.2b) and the retained enabling condition, which is the source
definition's own CR 611.3a gate riding along
(`effects/counter.rs::apply_source_static`). CR 611.2c freezes such an
effect's affected SET and nothing else, so both gates stay live and can flip
long after that set is fixed.

`any_active_static_condition_perturbed_by_entry` had the same `ForAsLongAs`
blind spot — 294ebcd6f gave it `tce.condition` only. It now iterates the same
authority, so a second condition-bearing `Duration` variant is wired into the
liveness evaluator, the read union, and the probe by editing one function. Its
`FilterContext` is hoisted out of the per-condition loop; CR 109.5 keeps "you"
in either retained gate bound to `tce.controller`, not to whoever controls the
source object now.

Docs: 27b8bf71e documented `e.condition` as "the single authority for the
condition channel: every `ActiveContinuousEffect` producer converges here".
That was false in both directions and is replaced by a WHAT CONVERGES WHERE
block naming each producer and the channel that actually sees it, including
the ring/emblem/sticker producers that carry no condition today, and the
`active_combat_assignment_rule_effects_from_static_definitions` /
`collect_transient_combat_assignment_rule_effects` pair, which duplicates the
same retain/strip logic for CR 613.11 effects and would need patching if a
condition channel is ever added there.

Tests: two entry-incremental fixtures whose only live read of NameText is a
transient gate — one source-level `tce.condition`, one `ForAsLongAs` duration
— plus a probe-channel fixture whose `ForAsLongAs` gate is started by an
opponent's entrant. Both read fixtures write with a layer-1 `SetName`
(CR 707.9b) rather than a layer-4 `AddType`: `evaluate_layers` gathers between
layer 1 and layer 2, so a gate can only observe base + layer-1 state, and a
type-based fixture cannot discriminate this seam.

Co-Authored-By: Claude <noreply@anthropic.com>
Assisted-by: ClaudeCode:claude-opus-5

The roster guard added in 27b8bf71e asserted `props.len() == 8` against the
literal array standing two lines above it, so it could only ever restate
itself — adding a `ControllerRef`-carrying variant to `FilterProp` left it
green, which is the one drift it claimed to catch.

Replace it with two authorities the test cannot edit. `carries_controller_ref`
is an exhaustive wildcard-free classifier, so a new `FilterProp` variant fails
to compile until it is classified; `declared_controller_ref_carriers`
source-scans the `FilterProp` declaration in `types/ability.rs` for the
variants that actually carry the field, so the sampled roster must equal the
enum. Dropping one sample now fails with the two variant-name lists diffed
against each other, and a new carrier turns the same assertion red until it is
sampled, classified, and shown to report a CONTROLLER read (CR 613.1b).

Also withdraws a claim in 27b8bf71e's own body: it said
`FilterProp::DistinctFrom` had been "matched by a `_ =>` wildcard inside a
classifier documented as exhaustive and wildcard-free — now an explicit arm".
`git show e7f856c:crates/engine/src/game/filter.rs` shows the parent already
had an explicit `match reference.as_ref()` arm; 27b8bf71e rewrote that arm
into an `if matches!(...)`, changing no behavior and no exhaustiveness. This
restores the `match` form as a readability change only, and the claim should
not be read as evidence of a fixed wildcard.

Co-Authored-By: Claude <noreply@anthropic.com>
Assisted-by: ClaudeCode:claude-opus-5

Round-5 review of this branch found the "single authority" claim in
27b8bf71e still only half true, and three comments claiming more than the
code proves.

Six sites re-implemented the dual-gate check inline (`casting.rs`, four in
`static_abilities.rs`, `turns.rs`) instead of asking
`transient_gate_conditions`. Each would have silently kept the old two-gate
shape if a third condition-bearing `Duration` variant were added. They now
call the iterator, which is `pub(crate)` for it. No behavior change: the
iterator yields exactly the pair each site open-coded. `casting.rs` also led
with CR 603.4 + CR 608.2h, neither of which describes "both gates must hold"
— it now cites CR 611.2b + CR 611.3a like the other five.

Docs corrected where they claimed more than the code delivers:

* WHAT CONVERGES WHERE is an enumerated producer table for
  `ActiveContinuousEffect::condition` rather than prose. It names all four
  `condition: None` producers, and states the consequence the prose had
  backwards: a GRANTED-INNER static's condition lives in `inner.condition`,
  which the source walk (over OUTER `obj.static_definitions.iter_all()`)
  cannot see until a prior pass has materialized it — so on a
  never-yet-evaluated state `e.condition` is the only channel that sees it.
  That is what makes the union load-bearing rather than redundant.
* `transient_gate_conditions` no longer claims `transient_effect_is_live`
  consults exactly this pair: it also applies a CR 400.7
  recipient-incarnation check and an `UntilHostLeavesPlay` source-zone
  check. Both read no layer-writable characteristic, which is why they sit
  outside the iterator and outside `live_characteristic_reads`. The
  lapsed-attachment sweep is named as the one deliberate non-consumer — it
  destructures a specific shape (CR 301.5) to decide expiry, not liveness,
  so routing it here would lose what it matches on.
* `declared_controller_ref_carriers` records its ceiling: the scan is
  textual, so a `ControllerRef` reached through a nested type stays
  invisible and the roster tripwire only catches total scan failure.

Tests: the source-level-condition fixture asserted the gather strips the
condition by inference from what it installed. It now runs
`gather_transient_continuous_effects` and asserts every produced effect has
`condition: None` — the strip is the whole premise of the test, so it is
asserted rather than assumed.

Co-Authored-By: Claude <noreply@anthropic.com>
Assisted-by: ClaudeCode:claude-opus-5

The previous commit claimed `transient_gate_conditions` is the authority
every consumer walks, and enumerated them. The enumeration was incomplete —
the same false-completeness defect it was written to fix.

Two sites still destructured the pair by hand:

* `static_abilities::object_has_active_cant_phase_in` wrapped it in a local
  `condition_holds` closure taking duration and condition as separate
  parameters, so it read as a helper rather than a duplicate.
* `visibility::viewer_may_look_at_face_down` inlined it under a comment
  saying it honors "the same duration/condition gates the static-mode TCE
  queries in `static_abilities.rs` apply" — naming the shared rule while
  keeping a private copy of it.

Both now call the iterator. No behavior change: it yields exactly the pair
each site open-coded, in the same order.

The doc no longer enumerates consumers, because an enumeration is what went
stale. It states the invariant and how to check it instead: outside
`layers.rs`, `Duration::ForAsLongAs` appears only in constructors, in the
`ability_rw` / `ability_scan` / `coverage` walkers that classify a duration
without evaluating it, and in the lapsed-attachment sweep documented as a
deliberate non-consumer. A new site that destructures the pair by hand is
the regression to look for.

Co-Authored-By: Claude <noreply@anthropic.com>
Assisted-by: ClaudeCode:claude-opus-5

…aluators

The consumer enumeration above `transient_gate_conditions` claimed every
consumer of the duration/condition pair routes through it, and offered
`Duration::ForAsLongAs` as the grep that would catch a new offender.

Both were wrong in the same direction: too broad a claim, too narrow a
grep. The claim now covers consumers that EVALUATE liveness. Two classes
are named as out of scope instead of silently contradicting it:

* Walkers that CLASSIFY a duration without evaluating it -- `analysis::resource`
  (two hand-destructuring sibling-mutability scans) plus `ability_rw` /
  `ability_scan` / `coverage`. They stay variant-safe through
  `ability_scan`'s exhaustive matches, not through this authority.
* Gate-blind consumers, disclosed as a tracked pre-existing gap:
  `casting::apply_static_activated_ability_cost_reduction` and
  `effects::attach::protection_blocks_attachment` apply a transient effect
  without consulting either gate. Routing them here changes behavior and
  needs its own CR analysis and tests.

The grep recipe becomes the iteration site `for tce in
&state.transient_continuous_effects`. `Duration::ForAsLongAs` only matches
sites that already destructure the duration, so it structurally cannot see
the gate-blind pair.

Also scopes the producer census: `active_continuous_effects_from_base_static_source`
is an alternate entry into an already-censused row, not a ninth producer, and
never feeds `evaluate_layers`.

Documentation only -- no production or test behavior changes.

Co-Authored-By: Claude <noreply@anthropic.com>
Assisted-by: ClaudeCode:claude-opus-5