fix(engine): make unresolved ParentObjectTargetController restriction fail-closed, not panic

Address maintainer review: the enforcement arm in
casting::restriction_scope_matches_player did debug_assert!(false) for
RestrictionPlayerScope::ParentObjectTargetController, but add_restriction's
fill_runtime_fields can legitimately leave that scope unresolved when there is
no object referent (proven by parent_object_target_controller_unresolved_without_object_target).
That made the documented fail-closed path unsafe: a castability query against
that stored state would panic in debug/test builds instead of restricting no
one.

Remove the debug assertion for this arm so it genuinely returns false
(fail-closed). Unlike the always-resolved sibling scopes (TargetedPlayer,
ScopedPlayer), this scope can reachably remain unresolved, so an unresolved
value is a valid state, not a bug.

Add an integration test that drives the public can_cast_object_now against the
stored unresolved restriction and asserts it restricts no one without panicking
— proving the fail-closed behavior, not just the stored enum shape.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WQcP6woAkU5iEBTkA9oQ6J

Author: claude

crates/engine/src/game/casting.rs

@@ -510,14 +510,16 @@ fn restriction_scope_matches_player(
             false
         }
         RestrictionPlayerScope::ParentObjectTargetController => {
-            // CR 109.4: resolved to `SpecificPlayer` by `add_restriction` when the
-            // restriction is created (via `parent_target_controller`), so an
-            // unresolved scope here means the object referent could not be found —
-            // fail-closed, restrict no one.
-            debug_assert!(
-                false,
-                "ParentObjectTargetController should be resolved by add_restriction"
-            );
+            // CR 109.4: normally resolved to `SpecificPlayer` by `add_restriction`
+            // (via `parent_target_controller`) when the restriction is created.
+            // Unlike the always-resolved sibling scopes (`TargetedPlayer`,
+            // `ScopedPlayer`), this one can legitimately remain unresolved when
+            // there is no object referent — a malformed or hostile state, proven
+            // reachable by `add_restriction`'s
+            // `parent_object_target_controller_unresolved_without_object_target`.
+            // That is a genuine fail-closed outcome (restrict no one), NOT a bug,
+            // so this arm must return `false` rather than `debug_assert!(false)` —
+            // a debug/test panic here would break the documented fail-closed path.
             false
         }
         RestrictionPlayerScope::OpponentsOfSourceController => {

crates/engine/tests/integration/render_silent_cant_cast.rs

@@ -16,6 +16,9 @@
 
 use engine::game::casting::can_cast_object_now;
 use engine::game::scenario::{GameRunner, GameScenario, P0, P1};
+use engine::types::ability::{
+    GameRestriction, ProhibitedActivity, RestrictionExpiry, RestrictionPlayerScope,
+};
 use engine::types::card_type::CoreType;
 use engine::types::game_state::{CastingVariant, StackEntry, StackEntryKind};
 use engine::types::identifiers::{CardId, ObjectId};
@@ -53,6 +56,59 @@ fn put_spell_on_stack(runner: &mut GameRunner, controller: PlayerId) -> ObjectId
     spell
 }
 
+/// CR 109.4 fail-closed enforcement: if an "its controller can't cast spells"
+/// restriction is ever stored with an UNRESOLVED `ParentObjectTargetController`
+/// scope (no object referent — the malformed/hostile state that
+/// `add_restriction`'s `parent_object_target_controller_unresolved_without_object_target`
+/// proves `fill_runtime_fields` can leave), a later castability query must return
+/// "unrestricted" and MUST NOT panic. This drives the public `can_cast_object_now`
+/// against exactly that stored state — it panicked before the enforcement arm's
+/// `debug_assert!(false)` was removed, and now returns fail-closed (restrict no
+/// one). Guards `casting::restriction_scope_matches_player`.
+#[test]
+fn unresolved_parent_object_target_controller_restriction_is_fail_closed() {
+    let mut scenario = GameScenario::new();
+    scenario.at_phase(Phase::PreCombatMain);
+
+    let mut p0_spell = scenario.add_spell_to_hand_from_oracle(P0, "P0 Spell", true, "Draw a card.");
+    p0_spell.with_mana_cost(ManaCost::Cost {
+        generic: 0,
+        shards: vec![ManaCostShard::Blue],
+    });
+    let p0_spell = p0_spell.id();
+    scenario.add_basic_land(P0, ManaColor::Blue);
+
+    let mut runner = scenario.build();
+
+    // Baseline: castable before any restriction exists.
+    assert!(
+        can_cast_object_now(runner.state(), P0, p0_spell),
+        "sanity: P0's spell must be castable before the restriction is stored"
+    );
+
+    // Store the hostile UNRESOLVED restriction directly — the exact state the
+    // sibling unit test proves `fill_runtime_fields` leaves when there is no
+    // object referent (scope stays `ParentObjectTargetController`, never lowered
+    // to `SpecificPlayer`).
+    runner
+        .state_mut()
+        .restrictions
+        .push(GameRestriction::ProhibitActivity {
+            source: ObjectId(9999),
+            affected_players: RestrictionPlayerScope::ParentObjectTargetController,
+            expiry: RestrictionExpiry::EndOfTurn,
+            activity: ProhibitedActivity::CastSpells { spell_filter: None },
+        });
+
+    // Fail-closed: the unresolved scope restricts NO ONE and must not panic. This
+    // call routes through `restriction_scope_matches_player`'s
+    // `ParentObjectTargetController` arm.
+    assert!(
+        can_cast_object_now(runner.state(), P0, p0_spell),
+        "an unresolved ParentObjectTargetController restriction must restrict no one (fail-closed)"
+    );
+}
+
 /// Put a spell on the stack whose OWNER and CONTROLLER differ: `owner` owns the
 /// card (so a counter sends it to `owner`'s graveyard, CR 701.6a) while
 /// `controller` controls it on the stack (e.g. a spell cast from another