Finding 3 of the 2026-07-29 security review: bids, passes and plays
were validated properly, but a kitty discard only checked that five
cards were named -- and cg-bid--discard removes cards with
cl-set-difference, which silently ignores cards not in the hand. A
client naming five cards it did not hold kept all fifteen and played
on with more cards than the rules allow.
New cg-bid--net-holds-p checks every named card against the seat's
hand, respecting multiplicity (five copies of one held card do not
pass). The check joins the phase/contractor/arity checks that already
live in the discard branch of cg-net-apply-move.
Test cgt-bid-net-discard-checked fails against the previous code: the
foreign discard was accepted (returned t) and the game advanced to
play with a 15-card hand.
3b55d780b0