# Exploits Log

Every exploit Phelan uses, logged for continuity tracking.

---

## Exploit #1: Dog Fear Curse — Sensory Channel Mismatch
- **Chapter:** Ch03
- **Target:** Fear curse anchored to visual processing channel (three primary anchors, two redundant supports, feedback loop)
- **Flaw:** Curse designed for human perceptual framework, applied to a dog. Dogs prioritize olfactory over visual data — the curse only controlled ~50% of the animal's response.
- **Method:** Three-layer intervention. (1) Binding salts weakened the magical signal. (2) Silverthorn suppressed the fear response. (3) Amplification sequence boosted scent processing. The curse's own feedback loop consumed more energy fighting contradictory data with each refresh cycle. Anchors failed in sequence. Curse collapsed from within.
- **Cost:** Full hyperfocus crash the night before (migraine, thornwell root required). Physical exhaustion, trembling, bloodshot eyes the morning of.
- **Flaw Sight used:** Yes — perceived full lattice from 12 feet (unusual range). Kept ability concealed from Mere.
- **Notes:** Binding salts and silverthorn treatment originated with Mere Fields (three weeks of independent trial and error). Phelan added the amplification layer to weaponize her existing approach.

## Exploit #2 (Leon D'Nardis): Ward Overload — Input Flooding
- **Chapter:** Ch05 (described in conversation, not witnessed)
- **Target:** Nested detection-and-response ward array on the Vethani Crypts. Fourteen layers, ~60 years old, pre-Compact era.
- **Flaw:** Ward designed to counter precision intrusion — each probe triggers a proportional response. System assumed input would be specific and surgical. No threshold for processing volume.
- **Method:** Generated ~400 simultaneous low-level magical inputs across all monitored channels. Random noise — no pattern to match, no precision to counter. Response array saturated trying to process contradictory data from 400 sources. Detection still ran but response mechanism locked up. Leon walked through.
- **Item recovered:** Mallory focusing crystal, pre-Compact, original inscription. Sold for 1,200 silvers to anonymous buyer.
- **Notes:** Brute-force cousin to Phelan's precision approach. Same philosophical family — exploit the working's own design assumptions. Important concept: input flooding as a technique.

## Exploit #3: Death Ward — Signature Forgery & Self-Redirect
- **Chapter:** Ch08
- **Target:** Death ward on second floor, third door, Greymarch Barrows. Pre-Compact construction. Converter-type ward — routes all external magical input through 26 conversion nodes (three concentric rings) and outputs as thermal energy. Designed by an engineer, not a theorist. Built to handle brute-force attacks (Leon's 400-input flood converted to heat without effect).
- **Flaw:** Imperfect conversion ratio (~2% leakage). The conversion process cannot be 100% efficient — fractionally narrower output channels than input channels. The 2% unconverted energy circulates internally through the routing matrix as the ward's own resting signature. This internal traffic is invisible to the external-facing conversion nodes, which are calibrated outward. The leakage broadcasts the ward's internal energy profile continuously — frequency, amplitude, phase offsets at seven routing junctions.
- **Method:** Three-phase exploit. (1) **Reconnaissance:** Deep Flaw Sight analysis mapped the ward's full architecture and the internal circulation signature over 8+ observation cycles. Passive, low energy cost, time-intensive. (2) **Forgery & Injection:** Phelan matched his magical output to the ward's internal signature — frequency (12.7 cycles/standard interval), amplitude, and phase offsets at all seven junctions. Fed forged energy through the 2% leakage seam into the internal channels. Ward accepted it as its own traffic. Built to ~12% of internal circulation volume. Sustained concentration required — any deviation in phase offset would trigger conversion nodes. High energy cost (reserves dropped from ~80% to ~50%). (3) **Redirect:** Altered routing destination on forged energy at junction five. Ward's conversion nodes processed the altered traffic as internal, converting the ward's own routing architecture to heat. Self-sustaining cascade — converted architecture produced debris that circulated to more conversion nodes, which converted more architecture. Ward consumed itself.
- **Cost:** Extreme. Reserves from ~80% to ~15%. Sustained precision output for extended duration. Physical symptoms: hand tremor, sweating, neck wound aggravated. Flaw Sight flickering at edges post-exploit. Crash incoming but not yet arrived at chapter's end.
- **Flaw Sight used:** Yes — full deep analysis engagement. Extended duration. The reconnaissance phase required the longest continuous Flaw Sight use to date.
- **Notes:** Most sophisticated exploit to date. Required theory developed in ch06 (conversation with Leon about conversion ratio and leakage). The exploit doesn't overpower the ward — it convinces the ward to destroy itself using its own conversion function. Philosophical principle: if a system has an imperfect process, the imperfection IS the access point. The ward's strength (efficient conversion) was also its vulnerability (the conversion couldn't distinguish self from forged self). Leon's brute-force attempt (Exploit #2 context) established that direct assault was futile, which forced the analytical approach.