Require a grant to reach the zone it is being used in

A MayPlay grant clears the restriction zone, and checkZoneRestrictions
then returned true for any null zone. So a grant that only reduces a
cost reached cards it was never meant to: with As Foretold out, an
opponent's hand was castable.

MayPlayDontGrantZonePermissions marks a cost reduction rather than
permission, so it is not enough on its own, but it must not get in the
way when a second grant does allow the zone - Grenzo pays {0} for cards
it does not own, and Heist is what lets them be cast at all. The card
reaching this point is a copy with no play options left, so the check
reads them off the real card, the same way the branch below it does.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: liamiak1

forge-game/src/main/java/forge/game/spellability/SpellAbilityRestriction.java

@@ -17,7 +17,6 @@
  */
 package forge.game.spellability;
 
-import java.util.List;
 import java.util.Map;
 import java.util.function.Predicate;
 
@@ -232,27 +231,28 @@ public final boolean checkZoneRestrictions(final Card c, final SpellAbility sa)
             if (sa.isSpell()) {
                 final CardPlayOption o = c.mayPlay(sa.getMayPlay());
                 if (o == null || sa.isCastFromPlayEffect()) {
-                    return this.getZone() == null || (cardZone != null && cardZone.is(this.getZone()));
+                    if (this.getZone() != null) {
+                        return cardZone != null && cardZone.is(this.getZone());
+                    }
+                    // A cleared zone means a grant is what allows this, so for someone else's card
+                    // some grant has to reach the zone it is in. The card here is a copy and has
+                    // no play options left, so they come off the real one.
+                    if (sa.isCastFromPlayEffect() || activator == c.getOwner()) {
+                        return true;
+                    }
+                    return hasZoneGrantor(activator.getGame().getCardState(c, null), activator);
                 } else if (o.getPlayer() == activator) {
                     Map<String,String> params = sa.getMayPlay().getMapParams();
 
                     // NOTE: this assumes that it's always possible to cast cards from hand and you don't
                     // need special permissions for that. If WotC ever prints a card that forbids casting
                     // cards from hand, this may become relevant.
                     if (!o.grantsZonePermissions() && cardZone != null && (!cardZone.is(ZoneType.Hand) || activator != c.getOwner())) {
-                        final List<CardPlayOption> opts = c.mayPlay(activator);
-                        boolean hasOtherGrantor = false;
-                        for (CardPlayOption opt : opts) {
-                            if (opt.grantsZonePermissions()) {
-                                hasOtherGrantor = true;
-                                break;
-                            }
-                        }
                         if (cardZone.is(ZoneType.Graveyard) && sa.isAftermath()) {
                             // Special exclusion for Aftermath, useful for e.g. As Foretold
                             return true;
                         }
-                        if (!hasOtherGrantor) {
+                        if (!hasZoneGrantor(c, activator)) {
                             return false;
                         }
                     }
@@ -280,10 +280,10 @@ public final boolean checkZoneRestrictions(final Card c, final SpellAbility sa)
             return false;
         }
 
-        // A zone restriction means the activator's own zone. CR 109.5: a card outside the
-        // battlefield has no controller, so the "you" in "your graveyard" is its owner.
-        // Shaman's Trance makes every graveyard count as the activator's.
-        if (sa.isSpell() && activator != c.getOwner() && this.getZone() != null
+        // Reaching here means the card is in a zone of the restricted type, and that has to be
+        // the activator's own. CR 109.5: a card outside the battlefield has no controller, so the
+        // "you" in "your graveyard" is its owner. Shaman's Trance makes every graveyard theirs.
+        if (sa.isSpell() && activator != c.getOwner()
                 && !(this.getZone() == ZoneType.Graveyard
                         && activator.hasKeyword("Shaman's Trance"))) {
             return false;
@@ -292,6 +292,19 @@ public final boolean checkZoneRestrictions(final Card c, final SpellAbility sa)
         return true;
     }
 
+    /** Whether any play option the activator has on this card reaches the zone it is in. */
+    private static boolean hasZoneGrantor(final Card c, final Player activator) {
+        if (c == null) {
+            return false;
+        }
+        for (CardPlayOption opt : c.mayPlay(activator)) {
+            if (opt.grantsZonePermissions()) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     /**
      * <p>
      * checkTimingRestrictions.