chapters 18 and 19 done

world/magic/exploits-log.md

@@ -175,27 +175,28 @@ Every exploit Phelan uses, logged for continuity tracking.
 - **Mere's observation:** Bracelet recovering faster than Phelan's reserves. She identified the pattern from her Ch10 conditional logic analysis — watching the colour progression and drawing conclusions Phelan hasn't caught up to yet.
 
 ## Exploit #5: Mallory Crystal — Credential Harvest & Authentication Swap
-- **Chapters:** Ch 10 (seed), Ch 20 (drain/data acquisition + realization), Ch 21 (heist + hack + reversal)
+- **Chapters:** Ch09 (drain/data acquisition), Ch16 (realization/processing), Ch18 (infiltration + rewrite)
 - **Target:** Mallory focusing crystal, pre-Compact artifact. Life-force drain mechanism with operator/target authentication, connection log, and feedback loop. Same crystal Leon recovered from Vethani Crypts (Exploit #2) and sold to anonymous buyer.
 - **Flaw:** Three compounding vulnerabilities:
   1. **No internal security hardening** — pre-Compact artifact never designed to resist analysis from within. Being drained gave Phelan internal access (Flaw Sight fired involuntarily during drain).
   2. **Connection log exposure** — crystal stamps its own signature on every connection record (needs to "remember" pathways for feedback loop). This signature is the crystal's private key.
-  3. **Overuse degradation** — version drift across hundreds of connection records degraded the crystal's internal signature. Authentication tolerance is loose — accepts signatures within a degraded range, not exact match.
+  3. **Overuse degradation** — version drift across hundreds of connection records degraded the crystal's internal signature. Authentication tolerance is loose — accepts signatures within a degraded range, not exact match. "The lock wears down after too many keys."
 - **Method:** Five-phase exploit (credential harvest & authentication swap):
-  1. **The Drain (Ch 20):** Combat with Kae. Kae drains Phelan through the crystal. Flaw Sight fires involuntarily during drain — split-second flood of crystal's internal architecture. Raw data: connection log, routing architecture, authentication structure. Cannot process in combat. Leon saves Phelan with 50 simultaneous fire spells.
-  2. **The Realization (post-Ch 20):** Hours later, debriefing with Leon. The noise replays the flash — connects fragments. Phelan realizes the flash was data: crystal's internal signature (private key), connection log (victim list), authentication structure. Being drained = being inside the system.
-  3. **The Heist (Ch 21):** Leon tracks Kae's movements. When Kae leaves hideout, Phelan infiltrates. Forged crystal signature bypasses hideout ward (ward trusts crystal's authentication). Reaches crystal physically.
-  4. **The Hack (Ch 21):** Forged signature authenticates Phelan as trusted internal process. Two changes: (a) revokes Kae's operator credentials, (b) rewrites operator/target logic — any future operator is classified as target. Drain mechanism reverses direction. Sustained, precise work under time pressure.
-  5. **The Reversal (Ch 21):** Kae returns, attempts to drain. Crystal classifies him as target. His own life force is pulled through. Feels what his victims felt.
-- **Cost:** Severe. The hack (Phase 4) requires sustained precise work at significant reserve cost. Hard crash post-exploit: exhaustion, temporary loss of magical ability, sensory distortion. Bracelet reservoir likely depleted.
-- **Flaw Sight used:** Yes — involuntary activation during drain (Phase 1), then analytical processing via the noise (Phase 2), then precision work during hack (Phase 4).
+  1. **The Drain (Ch09):** Combat with Kae. Kae drains Phelan through the crystal. Flaw Sight fires involuntarily during drain — split-second flood of crystal's internal architecture. Raw data: connection log, routing architecture, authentication structure. Cannot process in combat. Leon saves Phelan with wall-of-fire brute force.
+  2. **The Realization (Ch16):** Five days of background noise sorting. Fragments from Ch09 organized into full picture: crystal architecture, connection log, authentication structure. Key realization: bracelet and crystal performed a handshake during Ch09 — same makers, same era. Crystal marked bracelet as kin, logged its seal. Bracelet has trusted-process authentication. "The key had been in the lock since the tenement."
+  3. **The Infiltration (Ch18):** Phelan + Ledger infiltrate Compact safehouse where crystal is stored. Ledger bypasses outer ward (non-magical technique, Pathfinder seed). 3-minute window before inner wards register active manipulation. Phelan reaches crystal physically.
+  4. **The Rewrite (Ch18):** Bracelet's Ch09 handshake credentials authenticate Phelan as trusted internal process — overuse loosened recognition enough that the shape was "right enough" and the mechanism "too tired to check twice." Three changes: (a) reads connection log (every victim's signature, each dimmer than the last — diminishing returns), (b) revokes Kae's operator credentials by widening stress cracks from overuse, easing the designation out of its grooves, (c) rewrites operator/target logic — moves designation from single-seal binding to open binding (anyone who activates drain = target, not operator). Modification sealed and disguised as natural wear along existing stress fractures. "The perfect exploit is the one nobody knows happened."
+  5. **The Trap (dormant):** Crystal left in place at Compact safehouse. Not used on Kae (Kae surrendered willingly to Leon at separate location). Crystal is now a dormant trap — next user who reaches for it with intent gets classified as target. Connection log intact as evidence. Taking the crystal would expose the operation; leaving it as apparently damaged artifact preserves deniability.
+- **Cost:** Not specified as severe — Phelan planned for 2 minutes, executed within 3-minute window. No crash mentioned. Bracelet cooled post-exploit. Emotional cost higher than magical cost.
+- **Flaw Sight used:** Yes — involuntary activation during drain (Phase 1), background noise processing (Phase 2), precision work during rewrite (Phase 4). Lattice perceived as "a city seen from above at night."
+- **Ledger witnessed:** Ledger was three feet away during the entire rewrite (Phase 4). Six micro-reactions catalogued by Phelan's noise (held breath, jaw tension, half-step back, hand to belt, swallow, final composure shift). "That's not in any manual I've read." Firsthand testimony — cannot be deflected or explained away. Seeds Book 3 institutional pressure.
 - **Runic Flow rules applied:**
   - Rule 4 (magic leaves traces): connection log = stored traces. Crystal's signature embedded in each record.
   - Rule 5 (intent matters): crystal keyed to "operator drains target." Phelan changes who qualifies as operator vs. target — intent logic does the rest.
   - Rule 6 (curses are contracts): drain function is a contract. Phelan amends the terms, doesn't break the contract.
   - Rule 3 (complexity costs more): authentication swap is simpler than destruction — changing two fields, not dismantling architecture. This is why it works.
 - **Cross-reference:** Exploit #3 (death ward signature forgery) is the direct precedent. Both use signature acquisition → forgery → system manipulation. Key differences: Book 1 acquired signature externally (8+ passive observation cycles, exact match at 7 junctions); Book 2 acquired internally (being drained, within degraded tolerance window). Book 1 result was destruction (system consumed itself); Book 2 result is reprogramming (system survives but reversed). Philosophy evolves from "break the lock" to "change what the lock opens."
-- **Story significance:** Connection log serves as evidence of every victim drained (legal weight). Crystal survives as a trap — anyone in Book 3 who tries to use it gets drained. Locksmith identity elevated: doesn't break locks, changes what they open.
+- **Story significance:** Connection log serves as evidence of every victim drained (legal weight). Crystal survives as a dormant trap — anyone in Book 3 who tries to use it gets drained. Kae saved by Leon's words, not by the exploit — the exploit was infrastructure, the humanity was Leon's. Locksmith identity elevated: doesn't break locks, changes what they open.
 
 ## Observation: Drain Echo — Residual Channel Endpoint (Mere's Discovery)
 - **Chapter:** Ch13 (Book 2)