JacobWoodson
diff --git a/‎crates/engine/src/ai_support/filter.rs‎
Lines changed: 98 additions & 3 deletions b/‎crates/engine/src/ai_support/filter.rs‎
Lines changed: 98 additions & 3 deletions
diff --git a/‎crates/engine/src/game/ability_rw.rs‎
Lines changed: 69 additions & 3 deletions b/‎crates/engine/src/game/ability_rw.rs‎
Lines changed: 69 additions & 3 deletions
diff --git a/‎crates/engine/src/game/ability_scan.rs‎
Lines changed: 13 additions & 6 deletions b/‎crates/engine/src/game/ability_scan.rs‎
Lines changed: 13 additions & 6 deletions
@@ -38,9 +38,9 @@ use crate::game::engine::SimulationProbeGuard;
 use crate::game::functioning_abilities::game_functioning_statics;
 use crate::game::{casting, keywords, turn_control};
 use crate::types::ability::{
-    AbilityCost, AbilityDefinition, AbilityKind, ActivationRestriction, FilterProp, ParitySource,
-    ParsedCondition, QuantityExpr, ReplacementDefinition, ResolvedAbility, StaticDefinition,
-    TargetFilter, TargetRef, TriggerDefinition,
+    AbilityCost, AbilityDefinition, AbilityKind, ActivationRestriction, Effect, FilterProp,
+    ParitySource, ParsedCondition, QuantityExpr, ReplacementDefinition, ResolvedAbility,
+    StaticDefinition, TargetFilter, TargetRef, TriggerDefinition,
 };
 use crate::types::actions::GameAction;
 use crate::types::card_type::CardType;
@@ -1001,6 +1001,25 @@ fn resolved_ability_target_filters_safe(ability: &ResolvedAbility) -> bool {
             return false;
         }
     }
+    // CR 601.2c: A mana effect declares role-scoped target filters;
+    // `target_filter()` returns only the first. Scan them ALL here, or a POISON
+    // FilterProp in a non-first mana role filter would be silently treated as
+    // SAFE and its ChooseTarget candidates wrongly memoized. Memoization
+    // soundness is a conservative gate — over-scanning only costs a memo,
+    // under-scanning is a bug. `declared_filters()` (not `surfaced_filters()`):
+    // context-ref filters are conservatively POISON under
+    // `target_filter_all_props_safe`, the correct conservative direction here.
+    if let Effect::Mana {
+        target: Some(role), ..
+    } = &ability.effect
+    {
+        if !role
+            .declared_filters()
+            .all(|(_, f)| target_filter_all_props_safe(f))
+        {
+            return false;
+        }
+    }
     if let Some(sub) = &ability.sub_ability {
         if !resolved_ability_target_filters_safe(sub) {
             return false;
@@ -1280,6 +1299,82 @@ fn legality_equivalence_key(
 mod tests {
     use super::*;
     use crate::ai_support::candidate_actions;
+
+    /// Matrix rows 9a + 9b — the mana-role POISON scan is a PURE EXTENSION.
+    ///
+    /// `resolved_ability_target_filters_safe` reads `Effect::target_filter()`,
+    /// which returns only the FIRST declared role filter. For a `Both` role the
+    /// second filter would go unscanned and a POISON `FilterProp` inside it
+    /// would be wrongly treated as SAFE, wrongly memoizing `ChooseTarget`
+    /// candidates. Memoization soundness is a conservative gate: over-scanning
+    /// costs a memo, under-scanning is a bug.
+    ///
+    /// 9b is the paired over-application negative — no SINGLE-role verdict may
+    /// change. Fails if the arm is written with `any()`, with
+    /// `surfaced_filters()`, or so that it SHADOWS rather than supplements the
+    /// generic scan.
+    #[test]
+    fn mana_role_poison_scan_extends_without_tightening() {
+        use crate::types::ability::{
+            ManaProduction, ManaTargetRole, QuantityExpr, TargetFilter, TypedFilter,
+        };
+        use crate::types::identifiers::ObjectId;
+        use crate::types::player::PlayerId;
+
+        let poison = TargetFilter::Typed(
+            TypedFilter::default().properties(vec![FilterProp::AttackedOrBlockedThisTurn]),
+        );
+        let safe = TargetFilter::Player;
+        // Reach guard for the fixture itself: these must actually differ under
+        // the predicate, or every assertion below is vacuous.
+        assert!(!target_filter_all_props_safe(&poison));
+        assert!(target_filter_all_props_safe(&safe));
+
+        let ability = |role: Option<ManaTargetRole>| {
+            ResolvedAbility::new(
+                Effect::Mana {
+                    produced: ManaProduction::Colorless {
+                        count: QuantityExpr::Fixed { value: 1 },
+                    },
+                    restrictions: vec![],
+                    grants: vec![],
+                    expiry: None,
+                    target: role,
+                },
+                vec![],
+                ObjectId(1),
+                PlayerId(0),
+            )
+        };
+
+        // 9a: POISON hiding in the NON-FIRST role is still caught.
+        assert!(
+            !resolved_ability_target_filters_safe(&ability(Some(ManaTargetRole::Both {
+                recipient: safe.clone(),
+                count_source: poison.clone(),
+            }))),
+            "a POISON filter in the second mana role must not be memoized as SAFE"
+        );
+
+        // 9b: single-role verdicts are untouched in BOTH directions.
+        assert!(resolved_ability_target_filters_safe(&ability(Some(
+            ManaTargetRole::Recipient {
+                recipient: safe.clone()
+            }
+        ))));
+        assert!(resolved_ability_target_filters_safe(&ability(Some(
+            ManaTargetRole::CountSource {
+                count_source: safe.clone()
+            }
+        ))));
+        assert!(!resolved_ability_target_filters_safe(&ability(Some(
+            ManaTargetRole::Recipient {
+                recipient: poison.clone()
+            }
+        ))));
+        assert!(resolved_ability_target_filters_safe(&ability(None)));
+    }
+
     use crate::game::engine::apply_as_current_for_simulation;
     use crate::types::game_state::{
         ActiveSearchDecisionAuthority, ActiveSearchDecisionControl, CastPaymentMode,
 
@@ -3159,9 +3159,21 @@ fn legacy_effect(x: &Effect) -> bool {
         }
 
         // ---- Options-only carriers ----
-        Effect::Mana { target, .. }
-        | Effect::LoseTheGame { target }
-        | Effect::WinTheGame { target } => otf(target),
+        // CR 601.2c (D5): `Effect::Mana`'s target is a ROLE (`ManaTargetRole`),
+        // not a bare `Option<TargetFilter>`, so it can no longer share the
+        // or-pattern below. It must still be scanned: several shipping mana
+        // cards carry exactly the frozen event-context tags this visitor exists
+        // to find — `TriggeringPlayer` (Bubbling Muck, High Tide, Mana Flare)
+        // and `ParentTargetController` (Fertile Ground, Utopia Sprawl, Wild
+        // Growth, Shimmerwilds Growth). Dropping Mana from the visitor would
+        // silently change `legacy_*` verdicts for all of them. Scan EVERY
+        // declared role filter (`declared_filters`, not `surfaced_filters`) —
+        // the tags live on context-ref filters, which `surfaced_filters`
+        // excludes by definition.
+        Effect::Mana { target, .. } => target
+            .as_ref()
+            .is_some_and(|role| role.declared_filters().any(|(_, f)| legacy_target_filter(f))),
+        Effect::LoseTheGame { target } | Effect::WinTheGame { target } => otf(target),
         Effect::ChooseFromZone { filter, .. } => otf(filter),
         Effect::ReduceNextSpellCost { spell_filter, .. }
         | Effect::GrantNextSpellAbility { spell_filter, .. } => otf(spell_filter),
@@ -6555,6 +6567,60 @@ mod tests {
     use crate::types::ability::{
         AbilityKind, ChoiceType, Comparator, CountScope, PtValue, TargetSelectionMode,
     };
+
+    use crate::game::test_fixtures::mana_fixture_roles;
+
+    /// Matrix rows 15b + 17 — zero delta for the D5 frozen-event-tag visitor,
+    /// which reads `Effect::Mana`'s target DIRECTLY and bypasses
+    /// `Effect::target_filter()` entirely.
+    ///
+    /// CR 603.10a: this visitor exists to find frozen event-context tags, and
+    /// seven of the eleven fixture mana entries carry exactly those tags
+    /// (`TriggeringPlayer` on Bubbling Muck / High Tide / Mana Flare,
+    /// `ParentTargetController` on the four Auras). Deleting Mana from the
+    /// or-pattern to silence the compiler — the path of least resistance — would
+    /// silently flip all seven; writing the split arm with `surfaced_filters()`
+    /// would too, since the tags live on context-ref filters that
+    /// `surfaced_filters` excludes by definition. Both mistakes fail here.
+    #[test]
+    fn legacy_effect_verdict_unchanged_for_every_fixture_mana_role() {
+        use crate::types::ability::{ManaProduction, QuantityExpr};
+
+        for (name, role) in mana_fixture_roles() {
+            let sole = role
+                .declared_filters()
+                .next()
+                .map(|(_, f)| f)
+                .expect("every shipping role declares exactly one filter");
+            // The pre-change verdict: `otf(target)` over the bare filter.
+            let expected = legacy_target_filter(sole);
+            let effect = Effect::Mana {
+                produced: ManaProduction::Colorless {
+                    count: QuantityExpr::Fixed { value: 1 },
+                },
+                restrictions: vec![],
+                grants: vec![],
+                expiry: None,
+                target: Some(role.clone()),
+            };
+            assert_eq!(
+                legacy_effect(&effect),
+                expected,
+                "{name}: D5 frozen-tag verdict must be identical to the pre-role reading"
+            );
+        }
+
+        // Reach guard: at least one fixture role IS tagged, so the loop above is
+        // not vacuously comparing `false == false` everywhere.
+        assert!(
+            mana_fixture_roles().iter().any(|(_, role)| {
+                role.declared_filters()
+                    .any(|(_, f)| legacy_target_filter(f))
+            }),
+            "the fixture set must contain at least one frozen-tag-bearing role,              or this test proves nothing"
+        );
+    }
+
     use crate::types::counter::CounterType;
     use crate::types::identifiers::{ObjectId, TrackedSetId};
     use crate::types::player::PlayerId;
 
@@ -1018,12 +1018,19 @@ fn scan_effect(x: &Effect, mode: ScanMode) -> Axes {
             ScanMode::Conservative => Axes::CONSERVATIVE,
             ScanMode::LoopFirewall => {
                 let mut acc = scan_mana_production(produced, mode);
-                if let Some(t) = target {
-                    acc = acc.or(scan_target_filter(
-                        t,
-                        FilterReadContext::SnapshotOrEvent,
-                        mode,
-                    ));
+                // CR 601.2c: a mana target is role-tagged (recipient / count
+                // source). Scan EVERY declared role filter, mirroring the D5
+                // legacy scan (`ability_rw`) and the AI POISON scan
+                // (`ai_support::filter`) — a partial view here would let the
+                // loop firewall miss a target-derived axis.
+                if let Some(role) = target {
+                    for (_, filter) in role.declared_filters() {
+                        acc = acc.or(scan_target_filter(
+                            filter,
+                            FilterReadContext::SnapshotOrEvent,
+                            mode,
+                        ));
+                    }
                 }
                 acc
             }