more book2 story work

world/magic/exploits-log.md

@@ -174,6 +174,29 @@ Every exploit Phelan uses, logged for continuity tracking.
 - **Post-stress harmonic:** Carter observed harmonic settling patterns in the bracelet's inscription work after the crash. First external technical observation of bracelet behaviour. Sent note via Devod (technical terms preserved phonetically). **Carter now knows about the bracelet** — saw it while Phelan was unconscious ("Hard to keep a focusing matrix hidden from a craftsman when you're unconscious on his floor with your sleeve riding up").
 - **Mere's observation:** Bracelet recovering faster than Phelan's reserves. She identified the pattern from her Ch10 conditional logic analysis — watching the colour progression and drawing conclusions Phelan hasn't caught up to yet.
 
+## Exploit #5: Mallory Crystal — Credential Harvest & Authentication Swap
+- **Chapters:** Ch 10 (seed), Ch 20 (drain/data acquisition + realization), Ch 21 (heist + hack + reversal)
+- **Target:** Mallory focusing crystal, pre-Compact artifact. Life-force drain mechanism with operator/target authentication, connection log, and feedback loop. Same crystal Leon recovered from Vethani Crypts (Exploit #2) and sold to anonymous buyer.
+- **Flaw:** Three compounding vulnerabilities:
+  1. **No internal security hardening** — pre-Compact artifact never designed to resist analysis from within. Being drained gave Phelan internal access (Flaw Sight fired involuntarily during drain).
+  2. **Connection log exposure** — crystal stamps its own signature on every connection record (needs to "remember" pathways for feedback loop). This signature is the crystal's private key.
+  3. **Overuse degradation** — version drift across hundreds of connection records degraded the crystal's internal signature. Authentication tolerance is loose — accepts signatures within a degraded range, not exact match.
+- **Method:** Five-phase exploit (credential harvest & authentication swap):
+  1. **The Drain (Ch 20):** Combat with Kae. Kae drains Phelan through the crystal. Flaw Sight fires involuntarily during drain — split-second flood of crystal's internal architecture. Raw data: connection log, routing architecture, authentication structure. Cannot process in combat. Leon saves Phelan with 50 simultaneous fire spells.
+  2. **The Realization (post-Ch 20):** Hours later, debriefing with Leon. The noise replays the flash — connects fragments. Phelan realizes the flash was data: crystal's internal signature (private key), connection log (victim list), authentication structure. Being drained = being inside the system.
+  3. **The Heist (Ch 21):** Leon tracks Kae's movements. When Kae leaves hideout, Phelan infiltrates. Forged crystal signature bypasses hideout ward (ward trusts crystal's authentication). Reaches crystal physically.
+  4. **The Hack (Ch 21):** Forged signature authenticates Phelan as trusted internal process. Two changes: (a) revokes Kae's operator credentials, (b) rewrites operator/target logic — any future operator is classified as target. Drain mechanism reverses direction. Sustained, precise work under time pressure.
+  5. **The Reversal (Ch 21):** Kae returns, attempts to drain. Crystal classifies him as target. His own life force is pulled through. Feels what his victims felt.
+- **Cost:** Severe. The hack (Phase 4) requires sustained precise work at significant reserve cost. Hard crash post-exploit: exhaustion, temporary loss of magical ability, sensory distortion. Bracelet reservoir likely depleted.
+- **Flaw Sight used:** Yes — involuntary activation during drain (Phase 1), then analytical processing via the noise (Phase 2), then precision work during hack (Phase 4).
+- **Runic Flow rules applied:**
+  - Rule 4 (magic leaves traces): connection log = stored traces. Crystal's signature embedded in each record.
+  - Rule 5 (intent matters): crystal keyed to "operator drains target." Phelan changes who qualifies as operator vs. target — intent logic does the rest.
+  - Rule 6 (curses are contracts): drain function is a contract. Phelan amends the terms, doesn't break the contract.
+  - Rule 3 (complexity costs more): authentication swap is simpler than destruction — changing two fields, not dismantling architecture. This is why it works.
+- **Cross-reference:** Exploit #3 (death ward signature forgery) is the direct precedent. Both use signature acquisition → forgery → system manipulation. Key differences: Book 1 acquired signature externally (8+ passive observation cycles, exact match at 7 junctions); Book 2 acquired internally (being drained, within degraded tolerance window). Book 1 result was destruction (system consumed itself); Book 2 result is reprogramming (system survives but reversed). Philosophy evolves from "break the lock" to "change what the lock opens."
+- **Story significance:** Connection log serves as evidence of every victim drained (legal weight). Crystal survives as a trap — anyone in Book 3 who tries to use it gets drained. Locksmith identity elevated: doesn't break locks, changes what they open.
+
 ## Equipment: Focusing Ring (Carter's Custom Build)
 - **Chapter:** Ch13
 - **Builder:** Jonael Carterson ("Carter")