Phelan_Varrent/world/magic/exploits-log.md

Exploits Log

Every exploit Phelan uses, logged for continuity tracking.

---

Exploit #1: Dog Fear Curse — Sensory Channel Mismatch

• Chapter: Ch03
• Target: Fear curse anchored to visual processing channel (three primary anchors, two redundant supports, feedback loop)
• Flaw: Curse designed for human perceptual framework, applied to a dog. Dogs prioritize olfactory over visual data — the curse only controlled ~50% of the animal's response.
• Method: Three-layer intervention. (1) Binding salts weakened the magical signal. (2) Silverthorn suppressed the fear response. (3) Amplification sequence boosted scent processing. The curse's own feedback loop consumed more energy fighting contradictory data with each refresh cycle. Anchors failed in sequence. Curse collapsed from within.
• Cost: Full hyperfocus crash the night before (migraine, thornwell root required). Physical exhaustion, trembling, bloodshot eyes the morning of.
• Flaw Sight used: Yes — perceived full lattice from 12 feet (unusual range). Kept ability concealed from Mere.
• Notes: Binding salts and silverthorn treatment originated with Mere Fields (three weeks of independent trial and error). Phelan added the amplification layer to weaponize her existing approach.

Exploit #2 (Leon D'Nardis): Ward Overload — Input Flooding

• Chapter: Ch05 (described in conversation, not witnessed)
• Target: Nested detection-and-response ward array on the Vethani Crypts. Fourteen layers, ~60 years old, pre-Compact era.
• Flaw: Ward designed to counter precision intrusion — each probe triggers a proportional response. System assumed input would be specific and surgical. No threshold for processing volume.
• Method: Generated ~400 simultaneous low-level magical inputs across all monitored channels. Random noise — no pattern to match, no precision to counter. Response array saturated trying to process contradictory data from 400 sources. Detection still ran but response mechanism locked up. Leon walked through.
• Item recovered: Mallory focusing crystal, pre-Compact, original inscription. Sold for 1,200 silvers to anonymous buyer.
• Notes: Brute-force cousin to Phelan's precision approach. Same philosophical family — exploit the working's own design assumptions. Important concept: input flooding as a technique.

Exploit #3: Death Ward — Signature Forgery & Self-Redirect

• Chapter: Ch08
• Target: Death ward on second floor, third door, Greymarch Barrows. Pre-Compact construction. Converter-type ward — routes all external magical input through 26 conversion nodes (three concentric rings) and outputs as thermal energy. Designed by an engineer, not a theorist. Built to handle brute-force attacks (Leon's 400-input flood converted to heat without effect).
• Flaw: Imperfect conversion ratio (~2% leakage). The conversion process cannot be 100% efficient — fractionally narrower output channels than input channels. The 2% unconverted energy circulates internally through the routing matrix as the ward's own resting signature. This internal traffic is invisible to the external-facing conversion nodes, which are calibrated outward. The leakage broadcasts the ward's internal energy profile continuously — frequency, amplitude, phase offsets at seven routing junctions.
• Method: Three-phase exploit. (1) Reconnaissance: Deep Flaw Sight analysis mapped the ward's full architecture and the internal circulation signature over 8+ observation cycles. Passive, low energy cost, time-intensive. (2) Forgery & Injection: Phelan matched his magical output to the ward's internal signature — frequency (12.7 cycles/standard interval), amplitude, and phase offsets at all seven junctions. Fed forged energy through the 2% leakage seam into the internal channels. Ward accepted it as its own traffic. Built to ~12% of internal circulation volume. Sustained concentration required — any deviation in phase offset would trigger conversion nodes. High energy cost (reserves dropped from ~80% to ~50%). (3) Redirect: Altered routing destination on forged energy at junction five. Ward's conversion nodes processed the altered traffic as internal, converting the ward's own routing architecture to heat. Self-sustaining cascade — converted architecture produced debris that circulated to more conversion nodes, which converted more architecture. Ward consumed itself.
• Cost: Extreme. Reserves from ~80% to ~15%. Sustained precision output for extended duration. Physical symptoms: hand tremor, sweating, neck wound aggravated. Flaw Sight flickering at edges post-exploit. Crash incoming but not yet arrived at chapter's end.
• Flaw Sight used: Yes — full deep analysis engagement. Extended duration. The reconnaissance phase required the longest continuous Flaw Sight use to date.
• Notes: Most sophisticated exploit to date. Required theory developed in ch06 (conversation with Leon about conversion ratio and leakage). The exploit doesn't overpower the ward — it convinces the ward to destroy itself using its own conversion function. Philosophical principle: if a system has an imperfect process, the imperfection IS the access point. The ward's strength (efficient conversion) was also its vulnerability (the conversion couldn't distinguish self from forged self). Leon's brute-force attempt (Exploit #2 context) established that direct assault was futile, which forced the analytical approach.

Theoretical: Brute-Force Forgery (Hybrid Concept)

• Chapter: Ch10 (developed in conversation between Phelan and Leon, not yet deployed)
• Origin: Leon and Phelan riffing on the forge-and-redirect technique (Exploit #3). Combines Leon's volume approach (Exploit #2) with Phelan's precision forgery.
• Concept: Instead of one precisely forged signal injected through one seam, generate many forged signals matching the target's internal signature and inject through multiple seams simultaneously. Individual forgeries don't need to be perfect — the volume creates a statistical average that approximates the signature closely enough for the target to accept. Reduces observation cycles needed (one good sample instead of eight) but massively increases the energy cost of simultaneous generation.
• Trade-offs: Leon's pure volume is too imprecise to fool a well-built working. Phelan's pure precision is too slow to scale. The hybrid sacrifices some precision per signal for volume of attack vectors.
• Status: Theoretical only. Neither practitioner has tested it. The concept exists as a direction, not a technique.
• Potential application: Any working where forge-and-redirect is viable but time or observation cycles are limited. Seed for Floundry cure Layer 2 — the stabilizer may require faster, broader forgery than the death ward's single-seam approach allowed. Bracelet's focusing matrix may offset the precision loss, making the hybrid viable at lower volume.

Observation: Floundry Curse — Three-Layer Architecture (Initial Assessment)

• Chapter: Ch11
• Target: Curse on Ned Floundry. Classified "unbreakable" by Arcane Compact. Two curse-breakers failed (Practitioner Vellen, week 3; Practitioner Dorath, week 5).
• Method: Bracelet-enhanced Flaw Sight. Initial deep observation only — no exploit attempted.
• Findings: Three nested layers identified:
  • Layer 1 (Surface): Genuine degradation curse. Properly constructed, doing real damage. Targets systems in sequence: voice → hearing → motor control → organ function. This is what the curse-breakers and Compact assessed.
  • Layer 2 (Concealment): Hidden beneath Layer 1. What appeared as reinforcement patterns (that defeated the curse-breakers) is actually concealment — a second working running different logic on a different energy feed. The degradation curse is a facade (real but incomplete). "A wall built in front of a building."
  • Layer 3 (Unknown): Third structure beneath the concealment. Only partially resolved — at the edge of the bracelet's enhancement range. Outline visible but detail unclear.
• Assessment: Curse is engineered to appear unbreakable. Built with understanding of Compact assessment processes, curse-breaker methodology, and standard dissolution approaches. Same design philosophy as Greymarch death ward — architecture designed to defeat standard approaches before they arrive. Not anger. Engineering. Someone with specifications and inside knowledge.
• Cost: Not specified as significant. Bracelet stone amber-red, reservoir charged, buffer available. No crash or exhaustion noted.
• Flaw Sight used: Yes — bracelet-enhanced. Standard Flaw Sight would have shown only the surface layer (same as curse-breakers).
• Notes: Curse-breakers' methodology was suspiciously narrow — both used same dissolution family, same framework. Noise flagged this as potentially constrained (assessment parameters defined before assessment began). Compact's 11-day fast-track classification further supports predetermined outcome. Full analysis pending. Exploitation strategy not yet developed.

Analysis: Floundry Curse — Three-Layer Solution Mapping (Processing)

• Chapter: Ch12
• Target: Same curse — three nested layers identified Ch11.
• Method: Bracelet-enhanced memory recall at shack (not re-observation — working from imprint). Each layer mapped to a solution approach:
  • Layer 1 (Degradation): Stabilizer repairs faster than dissolution can damage. Even Leon's 400-input brute force wouldn't work — stabilizer is a dedicated repair mechanism, not a detection ward with a bottleneck. Solution: Ghostveil moss dampening. Binding salts/Sniff parallel (Ch03) — same principle, industrial scale. Ghostveil moss creates localised dampening field that suppresses active magical workings. Suppresses stabilizer long enough to crack Layer 1 conventionally. Preparation requires botanical precision (Mere's expertise). Compact has acquired all documented growth sites — must source from wild (Velken's Drift mine).
  • Layer 2 (Stabilizer): Solution: Forge-and-redirect (death ward technique, Ch08). Forge internal-looking data to confuse stabilizer into attacking its own system. Bracelet focusing matrix essential for precision. Known technique, new target.
  • Layer 3 (Anchor/Dead Man's Switch): Flaw visible — anchor bonded to Ned's life-force signature, but signature is drifting as curse changes him. Anchor recalibrates faster than drift progresses. UNSOLVED. Concept needed: how to accelerate life-force drift beyond anchor's recalibration speed. Not a magical problem — biological/alchemical. Solution from Devod (Ch16 — "move the lock" concept).
• Cost: Memory recall mode — minimal energy expenditure. Bracelet amber-red, reserves ~85–90%.
• Flaw Sight used: Enhanced recall only (bracelet focusing matrix sharpens imprints). No active observation.
• Notes: The Sniff parallel is explicit — binding salts (Ch03) → ghostveil moss is the same dampening principle scaled up. What Mere did intuitively on a simple working, they now need to do on a lethal three-layer structure. Compact suppression of ghostveil moss growth sites flagged as suspicious: same organisation that classifies curses as unbreakable also controls the countermeasure.

Combat Log: Focusing Ring — First Field Use (Mine Dogs)

• Chapter: Ch14
• Environment: Velken's Drift mine, second gallery east fork. High ambient magical residue (decades of ore extraction leakage). Flaw Sight completely offline — raw saturation, no structure to process.
• Opponents: Four mutated mine dogs — natural animals warped by sustained magical exposure. Oversized jaws and feet, compressed torso, hungry and aggressive.
• Performance:
  • Working 1: 12ft, clean kill. Residue amplified — more fire than intended. Ambient energy in stone added to output.
  • Working 2: Dampened by different residue pocket. Fire-weave sputtered, weak hit. Ring vibrated at threshold (Carter's warning confirmed). Required melee supplement — elbow redirect into wall, finished with close-quarters fire.
  • Working 3: 8ft, neutral residue, clean kill. No amplification or dampening.
  • Working 4: 10ft, off Devod's walking-stick deflection. Clean kill.
• Reserve cost: ~30% for four workings. Barrows reference: five workings against three crawlers cost 100% (Ch07).
• Ring calibration notes: Vibration threshold is real and physical — learn the feel. Residue variability means output is unpredictable: same ring, same technique, different result depending on local concentration. Adjust by feel, not formula. Don't trust consistent output in variable-residue environments.
• Melee integration: Held under pressure. Not smooth — residue forced manual adjustment on second dog. But muscle memory carried when magic stuttered. Fifteen years of dormancy, body remembered anyway.
• Assessment: "Not dormant anymore. Active inventory. Accessible. Functional." Ring changes combat math: 5-6ft unassisted → 12-15ft ring-assisted = three times engagement distance. The Barrows crawler that scarred his neck wouldn't have gotten close.

Combat Log: Focusing Ring — Second Field Use (Bandits)

• Chapter: Ch15
• Environment: Velken's Drift mine, south passage corridor near moss harvest gallery. Same high ambient magical residue as Ch14. Flaw Sight still offline. Corridor width allows two abreast.
• Opponents: Five hired operatives — professional, issued gear (bulk-purchased blade sheaths, lanterns, practical clothing). Led by experienced coordinator. Crossbowman, two blades, one cudgel (reserve/rearguard). On payroll for moss monitoring (Greenvale Provisions contract).
• Performance:
  • Working 1: Ring-assisted fire at crossbowman, 12ft. Residue pocket amplified (same as Ch14 Working 1). Knocked backward into wall, crossbow discharged into ceiling. First target eliminated to remove ranged threat.
  • Working 2: Defensive screen — flat plane of heated air between blade pair and Devod's position. Cost: 7% for a working that should cost 3% (residue doubles everything). Screen forces angle change, not full stop.
  • Working 3: Fire at leader, 8ft, residue neutral. Half-dodged — drove him sideways into wall. Not down. Finished with physical elbow strike to jaw. Unconscious.
  • Working 4: Fire at charging blade, 5ft close range. Ring straining, vibration starting. Working landed but reserves dropping in chunks. Residue getting denser deeper in corridor.
  • Working 5 (Devod assist): Devod dragged mine cart across corridor as barricade. Flanking blade hit cart, stumbled over wheel assembly. Devod struck wrist with walking stick (sword dropped), shoved cart to pin against wall. Not combat — "obstruction." Loading dock physics.
  • Cudgel man: Did not engage. Assessed outcome, surrendered weapon, cooperated.
• Reserve cost: ~70% → ~25-26% for five workings + screen at double residue rate. Bracelet wellspring then pushed reserves to ~32-34% (see Discovery entry below).
• Restraint: Bound all five with cargo hitches (Carter's quick-tie knots from packing session). Weapons collected. Only exit is flooded passage — not an option with hands tied.
• Assessment: First combat against humans. Ring performance confirmed under sustained use with ring strain. Melee integration (elbow on leader) held. Devod's mine cart improvisation was effective team combat without requiring combat training. Phelan's half-second read of the leader's decision to fight was the tactical advantage.

Discovery: Bracelet Wellspring — Reservoir Flow Reversal

• Chapter: Ch15
• Context: Post-combat assessment. Reserves should have been ~20% based on expenditure math. Actual: ~32-34%. Bracelet actively warm — same sensation as the Barrows' steady draw (Ch08), but direction reversed.
• Mechanism: The bracelet had been trickle-charging from Phelan's natural recovery since he put it on (the "slow leak" first noticed at 15% in Ch08). The reservoir filled over days. When Phelan's reserves dropped below an unknown threshold during combat, the bracelet reversed the flow — pushing stored energy back into his reserves.
• Answers: Mere's Ch10 question: "What happens when it's full?" — it saves for him. The conditional (if-then) notation she identified is the operating logic: if reserves drop below threshold, then reverse flow.
• Unknown:
  • Exact threshold trigger point
  • Whether the cycle repeats (charge → discharge → charge) or is one-time
  • Total reservoir capacity
  • Whether this was the original maker's intent or emergent behavior from old runic architecture developing "its own habits"
• Significance: The bracelet is not just a perception tool — it's an autonomous energy management system. Pre-Compact engineering operating on logic Phelan didn't write and can't fully read. "Patient, autonomous, operating on logic I hadn't written and couldn't have designed."
• Flaw Sight used: No — Flaw Sight offline in mine. Discovery was through physical sensation (warmth direction) and reserve math (numbers didn't add up).

Exploit #4: Floundry Cure — Three-Phase Coordinated Intervention

• Chapter: Ch19
• Target: Three-layer nested curse on Ned Floundry (degradation + stabilizer + dead man's switch anchor). Classified "unbreakable" by Arcane Compact.
• Method: Three phases executed in sequence (L3→L2→L1). Each phase uses a different technique targeting a different layer's specific weakness.

Phase 1: Anchor Drift (Layer 3)

• Concept origin: Devod Fields — "move the lock" cargo analogy (Ch16).
• Technique: Ghostveil moss at altered concentration applied to anchor points. Moss suppresses resonance between anchor and Ned's life-force signature — narrow-band dampening, not broad-spectrum. Anchor recalibrates, locks, drifts. Each cycle, lock is less certain. Anchor tightens parameters to compensate (grip tolerance contracting, recalibration speed pushing harder). Margin: 18% → 15 → 12 → 9 → 7 → 5. Anchor fires verification sequence — signature drifted past validation window. Kill trigger fires into empty space. Layer 3 goes dark.
• Phelan's role: Bracelet-enhanced Flaw Sight guidance — tracking validation window margin in real-time, ensuring the moss was driving drift effectively.
• Cost: 75% → 67% reserves. ~20 minutes. Precision-demanding but energy-modest. Bracelet buffered continuous Flaw Sight cost.
• Mere's role: Applied altered moss preparation to anchor points (temples, throat, collarbone, wrists). Removed paste after neutralisation.

Phase 2: Stabilizer Weaponisation (Layer 2)

• Concept origin: Leon D'Nardis — "Systems that monitor other systems can be made to accelerate the very failures they're trying to prevent" (Ch16).
• Technique: Forge-and-redirect (death ward technique, Ch08, adapted). Forged crisis data injected through stabiliser's monitoring channels — two-second windows, sub-second precision, 15 minutes sustained. Data mimicked catastrophic Layer 1 collapse (anchor-point degradation, cascading structural failure). Stabiliser overcompensated — dumped repair energy at emergency speed, overloaded its own channels. Stabiliser ate its own system and tore Layer 1's supporting framework apart.
• Cost: 67% → 16% reserves. ~15 minutes. Higher than estimated (51% actual vs. 22-28% planned). Bracelet reservoir nearly depleted. Physical symptoms: shaking hands, sweating, tunnel vision, iron taste.
• Bracelet role: Focusing matrix essential — injection windows too narrow and timing too precise without it. Reservoir buffered but exhausted.

Phase 3: Degradation Dissolution (Layer 1)

• Concept origin: Sniff parallel (binding salts, Ch03) scaled up. Standard curse-breaking.
• Technique: Standard ghostveil moss applied by Mere (30-60 minute dampening window). Conventional dissolution — wedge into structural weak points left by stabiliser's death throes, widen fractures, let stress cascade. Concentric rings of runic energy with force lines, many already shredded. Textbook: find the cracks, widen them, the structure eats itself. Dissolution radiates inward.
• Cost: 16% → 2-3% reserves. Duration uncertain (time became elastic). Bracelet stone practically black, focusing matrix barely functional. Personal reserves only. Physical: couldn't feel hands, vision tunnel, blood from bitten cheek.
• Mere's role: Applied standard moss, monitored dampening window, called "Twelve minutes remaining."

Overall Assessment

• Total reserves cost: 75% → 2-3% (73% total expenditure across three phases).
• Bracelet: Fully depleted. Stone dark. Reservoir exhausted during Phase 2.
• Crash: Post-Phase 3 collapse — Phelan chose not to fight it (trust > control, first time). Mere caught him.
• Team contribution: Every person essential. Devod's concept (Phase 1). Leon's insight (Phase 2) + monitoring. Mere's preparations (all phases) + vitals monitoring. Jonael's security (defeated Compact hired hands during Phase 2). Ledger's perimeter (Calla protection + hired hand deterrent). Devod left room during Phase 2 to help fight, returned afterward.
• The noise: Parentheticals disappeared entirely during execution — first and only time in the book. The noise became the work and, in becoming the work, disappeared.
• Significance: Most complex coordinated exploit to date. First team-dependent execution (prior exploits were solo). Three methods for three problems, each contributed by a different person. The "unbreakable" curse broken by identifying that it was three separate problems, each with a different vulnerability.

Exploit Refinement: Layer 2 — Stabilizer Weaponisation (Leon's Insight)

• Chapter: Ch16
• Origin: Leon D'Nardis riffing on forge-and-redirect (Exploit #3) applied to Floundry curse's stabilizer layer.
• Refinement: The stabilizer monitors Layer 1 and repairs damage. Instead of just disrupting the stabilizer, feed it forged crisis data showing catastrophic Layer 1 collapse. The stabilizer overcompensates — dumps repair energy into the degradation curse, but the degradation isn't actually collapsing. The repair function, running at emergency speed with nowhere to dump its output, overloads the channels and actively tears Layer 1 apart from the inside. The stabilizer is weaponised against the system it was built to protect.
• Leon's key insight: "Systems that monitor other systems can be made to accelerate the very failures they're trying to prevent."
• Technical requirements: Bracelet precision for two-second injection windows. Sub-second precision per injection. ~15 minutes sustained forging. Stabilizer monitoring interval drops under a second when reading crisis data ("it panics"). Reservoir cost: 22-28%. If bracelet exhausts mid-forge, precision drops to ~40% detection probability per cycle. Maximum three retry attempts before reservoir threshold.
• Status: Solution locked. Awaiting execution (L3→L2→L1 order — Layer 2 is second).

Exploit Concept: Layer 3 — Anchor Drift Acceleration (Devod's "Move the Lock")

• Chapter: Ch16
• Origin: Devod Fields, cargo analogy — "If you can't unlock the lock, move what it's locked to."
• Target: Dead man's switch anchor keyed to Ned Floundry's life-force signature.
• Key principle: The anchor requires signature verification before delivering kill trigger — a kill mechanism without verification fires into whoever's nearby. The keying is both safety and constraint. If the target's signature drifts past the validation window, the trigger fires into empty space.
• Method: The curse itself is already causing life-force drift (degradation changes Ned's signature). The anchor recalibrates faster than the natural drift — but ghostveil moss at altered concentration suppresses the resonance between anchor and signature, accelerating the drift beyond the anchor's recalibration ceiling. The anchor over-corrects, each correction widens the gap. Eventually the validation fails — trigger fires, finds nothing it recognises. "The lock is still locked. The chain is still whole. But the boat has moved."
• Moss preparation: Altered concentration — narrower band than standard dampening, targeting resonance frequency specifically. Living preparation (not dried, not standard extraction). Preserved root structures essential. 12-hour prep time. Requires one more bracelet-enhanced bedside observation for anchor resonance characteristics (recalibration speed, grip tolerance, bond weakness threshold).
• Dual moss use: Standard preparation for Layer 1 dampening. Altered concentration for Layer 3 drift acceleration. One ingredient, two applications. Mere's botanical expertise essential for both.
• Status: Concept locked. Awaiting resonance data (bedside observation) and Mere's 12-hour altered preparation.

Observation: Floundry Curse — Anchor Resonance Data Extraction

• Chapter: Ch18
• Target: Layer 3 anchor — dead man's switch keyed to Ned Floundry's life-force signature.
• Method: Bracelet-enhanced Flaw Sight. Surgical, controlled data extraction only — no deep analysis, no exploration. Clean engagement and disengagement.
• Data gathered:
  • Anchor recalibration speed: 0.7 cycles per interval, decaying (was 0.9 at first observation in Ch11). Anchor slowing.
  • Grip tolerance: Validation window contracted ~12% since Thursday (Ch11). Anchor tightening parameters to compensate for drift.
  • Bond weakness threshold: ~18% margin between current signature match and validation failure. Natural failure in 10–14 days at current drift rate. Cure needs to force failure tomorrow.
• Cost: ~5% reserves (from ~35% to ~30%). Minimal. No spiral, no hyperfocus corridor, no crash.
• Flaw Sight used: Yes — bracelet-enhanced directed perception. "Surgical, not investigative."
• Notes: Data enables Mere's altered concentration to target drift acceleration of ≥0.4 cycles minimum, outpacing anchor's recalibration ceiling of 0.7. The anchor is already struggling — recalibration speed decaying, grip tightening. The curse is changing Ned faster than when first observed. Controlled engagement demonstrated post-crash discipline — Phelan resisted the analytical pull successfully.

Discovery Update: Bracelet Wellspring — Repeating Behaviour Confirmed

• Chapter: Ch17
• Context: Hyperfocus crash. Phelan sustained a cognitive overload spiral (Ch16 continuation) — the bracelet's focusing matrix kept sharpening the corridor after his body was already shutting down. Reserves depleted past threshold. Bracelet went hot (burn, not warmth). 14 hours unconscious.
• Wellspring confirmation: Second flow reversal observed (first: Ch15 mine combat). Stone shifted to dark, tired colour between amber and black. Recovering visibly — warming back toward amber. Recharging faster than Phelan's personal reserves. Repeating conditional behaviour confirmed — not one-time. The if-then cycle repeats: charge → discharge when threshold breached → recharge.
• Safety limitation identified: The focusing matrix does not have a built-in mechanism to stop when the user's body is failing. It extended Phelan's cognitive reach past his physical capacity. "Like giving a man drowning a longer rope — he can reach further, but the water's still the same depth." Pre-Compact engineering built for practitioners who may have had different limits, or who were expected to know their own.
• Post-stress harmonic: Carter observed harmonic settling patterns in the bracelet's inscription work after the crash. First external technical observation of bracelet behaviour. Sent note via Devod (technical terms preserved phonetically). Carter now knows about the bracelet — saw it while Phelan was unconscious ("Hard to keep a focusing matrix hidden from a craftsman when you're unconscious on his floor with your sleeve riding up").
• Mere's observation: Bracelet recovering faster than Phelan's reserves. She identified the pattern from her Ch10 conditional logic analysis — watching the colour progression and drawing conclusions Phelan hasn't caught up to yet.

Exploit #5: Mallory Crystal — Credential Harvest & Authentication Swap

• Chapters: Ch09 (drain/data acquisition), Ch16 (realization/processing), Ch18 (infiltration + rewrite)
• Target: Mallory focusing crystal, pre-Compact artifact. Life-force drain mechanism with operator/target authentication, connection log, and feedback loop. Same crystal Leon recovered from Vethani Crypts (Exploit #2) and sold to anonymous buyer.
• Flaw: Three compounding vulnerabilities:
  1. No internal security hardening — pre-Compact artifact never designed to resist analysis from within. Being drained gave Phelan internal access (Flaw Sight fired involuntarily during drain).
  2. Connection log exposure — crystal stamps its own signature on every connection record (needs to "remember" pathways for feedback loop). This signature is the crystal's private key.
  3. Overuse degradation — version drift across hundreds of connection records degraded the crystal's internal signature. Authentication tolerance is loose — accepts signatures within a degraded range, not exact match. "The lock wears down after too many keys."
• Method: Five-phase exploit (credential harvest & authentication swap):
  1. The Drain (Ch09): Combat with Kae. Kae drains Phelan through the crystal. Flaw Sight fires involuntarily during drain — split-second flood of crystal's internal architecture. Raw data: connection log, routing architecture, authentication structure. Cannot process in combat. Leon saves Phelan with wall-of-fire brute force.
  2. The Realization (Ch16): Five days of background noise sorting. Fragments from Ch09 organized into full picture: crystal architecture, connection log, authentication structure. Key realization: bracelet and crystal performed a handshake during Ch09 — same makers, same era. Crystal marked bracelet as kin, logged its seal. Bracelet has trusted-process authentication. "The key had been in the lock since the tenement."
  3. The Infiltration (Ch18): Phelan + Ledger infiltrate Compact safehouse where crystal is stored. Ledger bypasses outer ward (non-magical technique, Pathfinder seed). 3-minute window before inner wards register active manipulation. Phelan reaches crystal physically.
  4. The Rewrite (Ch18): Bracelet's Ch09 handshake credentials authenticate Phelan as trusted internal process — overuse loosened recognition enough that the shape was "right enough" and the mechanism "too tired to check twice." Three changes: (a) reads connection log (every victim's signature, each dimmer than the last — diminishing returns), (b) revokes Kae's operator credentials by widening stress cracks from overuse, easing the designation out of its grooves, (c) rewrites operator/target logic — moves designation from single-seal binding to open binding (anyone who activates drain = target, not operator). Modification sealed and disguised as natural wear along existing stress fractures. "The perfect exploit is the one nobody knows happened."
  5. The Trap (dormant): Crystal left in place at Compact safehouse. Not used on Kae (Kae surrendered willingly to Leon at separate location). Crystal is now a dormant trap — next user who reaches for it with intent gets classified as target. Connection log intact as evidence. Taking the crystal would expose the operation; leaving it as apparently damaged artifact preserves deniability.
• Cost: Not specified as severe — Phelan planned for 2 minutes, executed within 3-minute window. No crash mentioned. Bracelet cooled post-exploit. Emotional cost higher than magical cost.
• Flaw Sight used: Yes — involuntary activation during drain (Phase 1), background noise processing (Phase 2), precision work during rewrite (Phase 4). Lattice perceived as "a city seen from above at night."
• Ledger witnessed: Ledger was three feet away during the entire rewrite (Phase 4). Six micro-reactions catalogued by Phelan's noise (held breath, jaw tension, half-step back, hand to belt, swallow, final composure shift). "That's not in any manual I've read." Firsthand testimony — cannot be deflected or explained away. Seeds Book 3 institutional pressure.
• Runic Flow rules applied:
  • Rule 4 (magic leaves traces): connection log = stored traces. Crystal's signature embedded in each record.
  • Rule 5 (intent matters): crystal keyed to "operator drains target." Phelan changes who qualifies as operator vs. target — intent logic does the rest.
  • Rule 6 (curses are contracts): drain function is a contract. Phelan amends the terms, doesn't break the contract.
  • Rule 3 (complexity costs more): authentication swap is simpler than destruction — changing two fields, not dismantling architecture. This is why it works.
• Cross-reference: Exploit #3 (death ward signature forgery) is the direct precedent. Both use signature acquisition → forgery → system manipulation. Key differences: Book 1 acquired signature externally (8+ passive observation cycles, exact match at 7 junctions); Book 2 acquired internally (being drained, within degraded tolerance window). Book 1 result was destruction (system consumed itself); Book 2 result is reprogramming (system survives but reversed). Philosophy evolves from "break the lock" to "change what the lock opens."
• Story significance: Connection log serves as evidence of every victim drained (legal weight). Crystal survives as a dormant trap — anyone in Book 3 who tries to use it gets drained. Kae saved by Leon's words, not by the exploit — the exploit was infrastructure, the humanity was Leon's. Locksmith identity elevated: doesn't break locks, changes what they open.

Observation: Drain Echo — Residual Channel Endpoint (Mere's Discovery)

• Chapter: Ch13 (Book 2)
• Context: Devod Fields drained by pre-Compact Mallory crystal (Ch12). Life force extracted, dramatic aging. Crystal removed from contact, but vitality not stabilizing as expected.
• Discovery: Mere Fields identifies a drain echo — a residual channel endpoint left open in Devod's system after the crystal was removed. Pre-Compact crystal architecture doesn't just extract; it anchors a channel between crystal and target. Removing the crystal closes one end, but the target-side endpoint remains open, continuing a faint pull on the victim's vitality. Like pulling a nail out but leaving the wound open.
• Detection method: Binding salts applied at pulse points (standard stabilization). Salts at the left wrist darkened faster than at other points — indicating active magical draw still occurring. Fresh salts confirmed: repeated darkening at the same location. Pattern recognition, not spellcasting.
• Treatment: Concentrated binding salt compound (denser than standard) applied at the channel endpoint (left wrist). Binding salts' dampening properties close the residual channel. Confirmation: fresh salts hold their colour. Drain echo neutralized.
• Flaw Sight note: Phelan's passive awareness detected a faint, diffuse sense of something off around Devod — but the drain echo was too faint and structureless for Flaw Sight to parse. Like hearing a hum you can't locate. The discovery belongs entirely to Mere's material-based detection.
• Significance: Establishes that pre-Compact crystal draining leaves persistent aftereffects even after crystal removal. The "battery drain" model: Devod's vitality was drained (not his mage reserves — he is not a mage). Body capacity intact; recovery is natural regeneration once the echo is stopped. Permanent cost: 1-2 years of burned capacity from the most violent extraction phase (Devod 55 → settles at 56-57). Seeds Mere's Phase 2 treatment (restorative tonics, Ch14-21) and her later expertise in crystal damage recovery (applied to Kae's pain management, Ch19-21).
• Cross-reference: Same crystal as Exploit #2 (Leon's Vethani Crypts recovery), Exploit #5 (credential harvest), Combat Log Ch09 (First Contact drain).

Combat Log: First Contact with Kae — Crystal Drain Survived

• Chapter: Ch09 (Book 2)
• Environment: Ground-floor tenement unit, southern warrens. ~12x15 feet. Near-dark (past tenth bell, winter night). Furniture as obstacles: cot, dresser, table, chair. Room progressively destroyed during fight — cot catches fire, table flipped, chair shattered, walls scorched. Smoke filling ceiling.
• Opponent: Kaeran "Kae" Thrainn — crystal-enhanced, no combat training, driven by pain/withdrawal. Green eyes, unfocused. Carved snake pendant.
• Performance:
  • Phase 1 (Evasion): Phelan tried de-escalation ("I'm not here to hurt you"). Failed — Kae in too much pain to reason. Three attacks dodged/absorbed: haymaker (cracked plaster), lunge (stumbled Phelan into wall), kick (sent table into dresser). All exits blocked.
  • Phase 2 (Brute-force fire): Reverted to primitive heat blasts — wide, unfocused, radiating spheres. NOT ring precision. Fire effective: Kae shielded face reflexively (nerve endings still report temperature even when crystal manages chronic pain). Burns registered. But Kae kept coming through fire. Phelan took hits: knee to shoulder, punch to same shoulder.
  • Phase 3 (Ring deployment): Created 8ft distance. Ring engaged — flame whip (quick-draw, not charged arc). Three strikes: forearm (scream), other arm elbow-to-wrist, third pushing Kae back. Briefly winning.
  • Phase 4 (Crystal drain): Kae lunged to dresser, grabbed crystal from bottom drawer (under cloth). Turned on Phelan. DRAIN: Fire died, ring cold, cognitive freeze, noise went SILENT (first time ever), world narrowed, vitality siphoned. Flaw Sight fired involuntarily — split-second flash of crystal architecture (fragments, not processed insight). Bracelet flared white-hot, absorbed worst of drain. Duration: 3-4 seconds.
  • Phase 5 (Leon's rescue): Leon through shutters. Wall of fire — multiple simultaneous projections, Telessi sleeve cherry-red. Broke the drain. Kae fled.
• Reserve cost: Not precisely tracked. Ring drained/cold post-crystal. Bracelet at half power. Phelan physically depleted — grey vision edges, legs unreliable, noise at ~70% rebuilding.
• Injuries: Left wrist red/irritated from bracelet's white-hot flare. Shoulder hit twice (knee + punch). No serious physical damage.
• Flaw Sight used: Yes — involuntary activation during drain. Fragments captured: lattice structure, biological routing, connection log (hundreds of impression stamps with crystal's own signature), two anchoring categories (operator/target), worn seal from overuse, feedback pathways. Cannot process — locked in memory. Seeds Ch18 realization.
• Assessment: Fire combat reverted to primitive under pressure — months of precision training irrelevant at close range. Ring effective when distance established but Kae closed gaps too fast. Crystal drain survivable only because of bracelet. Leon's brute-force rescue was the decisive factor. Kae's lack of training makes him MORE dangerous — can't predict someone who doesn't know their own next move.

Ward Break: Paper Talisman — Trivial

• Chapter: Ch09 (Book 2)
• Target: Mass-produced paper talisman on tenement window. Crenshaw and Howell manufacture (~400/week). Detection and alarm only, minimal range, no offensive capability.
• Flaw: Total structural inadequacy. Single detection loop tied to frame. Trigger threshold set for window opening, not for being touched. No redundancy, no fallback.
• Method: Flaw Sight — lightest engagement. Pinched the detection loop at weakest node (ink-thin junction where inscription meets adhesive backing). Loop collapsed inward. Ward went dark.
• Duration: Four seconds.
• Cost: Negligible.
• Notes: Routine Locksmith work. Phelan and Leon have broken "hundreds" of these. Contrast with serious ward work — this is the baseline, not the challenge.

Training Development: Sustained Channelling — Ring Capability Evolution

• Timeline: Book 1 epilogue through Book 2 opening (~3 months of daily training with Leon D'Nardis)
• Focus: Extending integrated casting duration through the focusing ring — fire + targeting + movement as one system
• Progression:
  • Book 1 epilogue: 12 seconds integrated (ceiling)
  • Book 2 Ch01: 12.5 seconds (Leon's volume sparring, ceiling moved)
  • Book 2 Ch02: 13 seconds (accuracy work, sustained thread at chalk target, 12 paces — ugly, 50% success rate)
  • Book 2 Ch07: 13 seconds (ugly but stable, absorbing instead of correcting — "almost gone")
  • Book 2 Ch08: 14 seconds (ugly, unstable past twelve, targeting drift only in last half-second — full second longer than previous ceiling. Key change: absorbing through instability instead of correcting)
• Key limitation: Targeting locks in at ~9 seconds. Environmental disruption before that window causes compensation rather than absorption. The ring's micro-pulse (~1.3 second stabilisation rhythm) saturates instinct past 12 seconds, causing handoff to conscious correction which overcorrects and introduces drift.
• Training method: Leon provides variable-timing heat pressure from off-angle during sustained thread exercises. Tests structural absorption vs. reactive compensation.
• Significance: The ring's original specification (Ch13) was 15–20ft range. Sustained channelling extends this to 25–30ft trained, 35–40ft theoretical maximum. The 3-month training arc moves the ring from a range multiplier to a sustained combat tool. Full technique documentation: /world/magic/fire-magic.md

Equipment: Focusing Ring (Carter's Custom Build)

• Chapter: Ch13
• Builder: Jonael Carterson ("Carter")
• Origin: Depth-staggering principle from Phelan's knife fix (Ch09). Carter applied the thermal distribution concept to a new form factor — a focusing ring as secondary anchor point for fire-weave projection.
• Function: Three staggered channel depths in spiral pattern. Convergence architecture at focal point on outer face. Fire-weave projects from ring's focal point instead of directly from hand. Secondary anchor refines and extends output — "clean output from dirty input."
• Range improvement: 5-6 feet (unassisted) → 15-20 feet (with ring). Multiplicative, not additive.
• Limitations: Don't push past 20 feet until practiced. Vibration in metal = convergence destabilizing, pull back immediately. Tolerance threshold on focusing channels.
• Cost: 12 silvers (materials only — store credit from Ch09 covered labor, Carter donated time as gift, credited technique to Phelan).
• Notes: Carter saw the neck wound scar from the Barrows crawler (Ch07/09) and built this without mentioning the scar. Competence expressed through craft. The ring changes Phelan's combat math significantly — the crawler got inside his guard because his range was shorter than its reach.