Skip to content
KN-86 Deckline

Gameplay Framework Walkthrough (V) — a Hot Swap, when one phase needs another cart

Scope: the first two-cart, two-phase job — an AAA arc, PENETRATE → ANALYZE → OBTAIN. Phase 1 is a live NETWORK breach (ICE BREAKER, mini-game); Phase 2 is a FINANCIAL forensic trace (BLACK LEDGER, grammar). The phase change is forced by capability: you can exfil the encrypted ledger in ICE BREAKER but you cannot read it there — so you swap carts mid-contract. The point is that the swap rides the same spine everything else does.

The contract: PAPER TRAIL — breach GLASS-CORP, lift the live books, then follow them home

Section titled “The contract: PAPER TRAIL — breach GLASS-CORP, lift the live books, then follow them home”

0 · The board

Section titled “0 · The board”

Operator HOSHIKO boots — the GLASS-CORP regular. Mission Control synthesizes the board seeded by Universal Deck State — reputation sets the threat tier, and the Capability Registry (the cartridge_history bitfield) shows both ICE BREAKER (0x01) and BLACK LEDGER (0x03) registered. That lets the board compose a multi-capability contract — one whose :required-capabilities span two carts. ICE BREAKER is the inserted cart; the contract is marked swap-required for its second phase. One surfaces: PENETRATION → ANALYSIS · NETWORK→FINANCIAL · T4 · ¤1900. → foundations: Board ↔ UDS + required capabilities (mission-control.md §3; Capability Registry, ADR-0028)

1 · The type — a CHAIN, not a class

Section titled “1 · The type — a CHAIN, not a class”

Where the first four jobs were a single class (one Tier-3 verb × affinity), this is an arc: the AAA chain PENETRATE → ANALYZE → OBTAIN — PENETRATION (breach the network) then ANALYSIS (trace the books), with the OBTAIN payoff (the named beneficiary) settling at the end. The two phases sit in different affinities, so the chain is only legal because DIGITAL→FINANCIAL is a sanctioned transition — “the data trail leads to bank records.” That sentence is the whole contract. → A the CHAIN arc (mission-type-catalog.md; the sanctioned transition, mission-composition-grammar.md (deleted 2026-07-29; recover from git history) §2)

2 · Accept → the phase chain loads

Section titled “2 · Accept → the phase chain loads”

The objective graph spans two phases, and phase_chain (the variable-length record persisted in UDS) carries the contract across the swap:

PHASE 1 · ICE BREAKER — PENETRATION · NETWORK
○ P1  Breach the finance subnet           ¤400        primary · briefed · on-complete
○ P2  Exfil the (encrypted) ledger        ¤600        primary · briefed · :requires P1 · on-complete   ← banked BEFORE the swap
+ O1  Quiet breach — :hold (trace < 50)    +2 REP      optional · briefed · on-resolve (escrow)


PHASE 2 · BLACK LEDGER — ANALYSIS · FINANCIAL   (unlocks on swap)
○ P3  Trace the shells, name the beneficiary  ¤900     primary · briefed · :requires P2 · on-resolve
◌ O2  [latent] Co-conspirator                 ¤400 +INTEL  optional · revealed @ branching shell · on-resolve

Mission succeeds when P1 + P2 + P3 are :done. Note the timing: P1/P2 pay on-complete (banked before the swap — the breach pay is locked in regardless of what Phase 2 does), while O1/P3/O2 are on-resolve escrow that settles only at the final (complete-mission). → foundations: objective graph + reward timing (mission-objectives.md §3, ADR-0043); the phase chain (deck-state.md, phase-chain-format.md)

3 · Phase 1 recon, then the breach — (load-capability :ice-breaker)

Section titled “3 · Phase 1 recon, then the breach — (load-capability :ice-breaker)”

She cases first: bzbx against GLASS-CORP’s simulated network ((launch-app :bzbx :world network-topology)), a passive SCAN + one active PROBE on the finance node → (dossier-commit acct:glass-corp:finance-topology). Her standing GLASS-CORP profile de-risks the entry. Then she jacks into the mini-game — the real-time OODA netrun — working Tier-2 INTRUSION verbs: CORE CRACK to defeat the ICE, COMPOSITE GHOST = CONS(MASK, JUMP) to ride under the log threshold for O1. She reaches the finance store → (goal-complete 'P1) → ¤400 banked, and SIPHONs the ledger out → (goal-complete 'P2) → ¤600 banked. But the ledger is encrypted — bytes, not books. → C recon (recon-mode.md) · D bzbx world (enrichment-contract.md) · E mini-game + B CORE/COMPOSITE INTRUSION verbs (capability-shapes.md, verb-partition.md)

4 · They hit back — knSALK, in the hot phase

Section titled “4 · They hit back — knSALK, in the hot phase”

The breach is offense, and offense raises trace that routes to the deck. The PROBE plus her time on the finance node push trace past the threshold → counter-intrusion. knSALK’s passive shield eats the first pass; the loud SIPHON punches through → breakthrough → the netrun interrupts → the active stand (DEFENDER grammar: QUARANTINE, BANISH). She wins it — but the spike pushed trace over 50, so the O1 ghost is blown. (This is the hot half of the contract; hold the thought for §6.) → F knSALK: heat-triggered, passive → active (knsalk.md)

5 · The Hot Swap — the phase change

Section titled “5 · The Hot Swap — the phase change”

She has the ledger but no way to read it. CIPHER flags the capability gap: gap — financial-forensics / not loaded. She presses QUOTE to swap. The runtime’s cartridge-lifecycle FSM serializes the phase chain and the network freezes at half-tempo:

  • persists (UDS, durable): phase_chain (Phase 1 :done, the exfil handle), credit_balance (the ¤1000 already banked), reputation, cartridge_history, the CIPHER coherence_stack (so the voice keeps its thread across the swap)
  • resets (run-state, volatile): the network map, the cell pool — and trace: ICE BREAKER’s trace doesn’t carry; BLACK LEDGER’s run starts cold

She ejects ICE BREAKER, inserts BLACK LEDGER. The FSM deserializes the chain, sees Phase 1 done, Phase 2 next, here is the exfil handle, and loads Phase 2. CIPHER resumes — colder, editorial now — bridging the thread: the wire gave up the book / now read it. → foundations: the Hot Swap mechanic + serialization (cartridge-lifecycle.md, phase-chain-format.md); the sanctioned UDS write boundary (ADR-0040 §6); CIPHER coherence across the swap (runtime/cipher-voice.md)

6 · Phase 2 — (load-capability :black-ledger) — the cold half

Section titled “6 · Phase 2 — (load-capability :black-ledger) — the cold half”

Now the exfiltrated ledger is the case. BLACK LEDGER’s capability is a grammar shape — it hands the dataset to AmberCalc to crunch ((launch-app :ambercalc :payload ledger-dataset)) and overlays the FORENSICS verbs. She TRACEs GLASS-CORP → Caribbean Trust → Cayman Finance, FLAGs the round-number outflows, CHAIN = CONS(FLAG, FLAG)s them into evidence. A branching shell (Company D, two parents) reveals the co-conspirator → (goal-reveal 'O2); she takes it, spending move budget. She names the beneficiary → (goal-complete 'P3). And note what doesn’t happen here: no heat. Reading exfiltrated records is analysis, not offense — the books don’t trace back. knSALK stays dormant for the whole phase. One contract, two heat stories, divided exactly at the swap. → E grammar + B FORENSICS verbs (capability-shapes.md, verb-partition.md) · D AmberCalc (enrichment-contract.md) · F dark this phase — cold analysis (knsalk.md)

7 · The OBTAIN — the verdict is the asset

Section titled “7 · The OBTAIN — the verdict is the asset”

The named beneficiary is the OBTAIN that closes the AAA arc: intelligence as a recovered asset. It lands in DOSSIER as a :verified fact-node under the GLASS-CORP profile — and becomes recon intel for a future job (a breach of the beneficiary’s own accounts would start pre-seeded). The knowledge currency threads forward, exactly as in III. → foundations: DOSSIER + the cross-job knowledge loop (programs/dossier-data-model.md)

8 · Resolve — (complete-mission) settles the whole chain

Section titled “8 · Resolve — (complete-mission) settles the whole chain”

All three primaries :done. Only now does the on-resolve escrow settle:

GoalRewardOutcome
P1¤400kept (banked in Phase 1, survived the swap)
P2¤600kept (banked in Phase 1)
O1+2 REPforfeited — the trace spike in §4 broke the quiet breach
P3¤900paid (chain succeeded)
O2¤400 + INTELpaid — co-conspirator named and held up

One sanctioned UDS write (ADR-0040 §6): credit_balance += 2300, reputation += the success delta (no ghost bonus), the beneficiary key → DOSSIER, cipher_seed advances, and phase_chain clears. → foundations: the economy across phases (economy-model.md)

Coverage — every piece, across two carts

Section titled “Coverage — every piece, across two carts”
PieceWhere
A — mission-type catalogthe AAA CHAIN PENETRATE→ANALYZE→OBTAIN; DIGITAL→FINANCIAL sanctioned (§1)
B — verb partitionINTRUSION CRACK/GHOST (§3) + FORENSICS TRACE/FLAG/CHAIN=CONS (§6) — two spines in one run
C — recon modebzbx casing before the breach (§3)
D — program enrichmentbzbx world (§3) and AmberCalc (§6)
E — capability shapesICE BREAKER mini-game (§3) and BLACK LEDGER grammar (§6), bridged by the swap
F — knSALKfires in the hot phase (§4), dark in the cold phase (§6) — split at the swap
phase chain / Hot Swapthe swap, serialization, persist-vs-reset (§2, §5) — the centerpiece
objective modeltwo-phase graph; on-complete banks before the swap, on-resolve settles at the end (§2, §8)
economy¤ + reputation + two per-cart masteries + knowledge all move (§8)
DOSSIERde-risk in (§3), verdict out (§7)
Board ↔ UDSmulti-capability contract from the registry; one sanctioned write (§0, §8)

Why this proves coherence — the chain test

Section titled “Why this proves coherence — the chain test”

The earlier four held the contract to one cart so the pieces could be read cleanly. This one lets the contract cross a cartridge boundary and shows nothing breaks:

  1. The swap rides the same spine. A Hot Swap is not a special mode — it’s a serialize of phase_chain at an eject/insert boundary. Durable state (credits, reputation, the chain, CIPHER’s thread) lives in UDS and crosses; run-state (the map, the trace) is per-capability and resets. The operator changes carts; the contract never notices.
  2. “Required capabilities” is the board doing exactly what it claimed. The Capability Registry composed a contract that needs two carts, surfaced it as swap-required, and the AAA arc was legal only because DIGITAL→FINANCIAL is a sanctioned transition. The board-↔-UDS wiring the first walkthrough asserted is the same wiring that makes a multi-cart job possible.
  3. Heat is per-capability — and the swap is where you can see it. One contract, two heat stories: the live breach routes trace to the deck and knSALK fires (the hot half); the forensic read of the already-stolen books raises nothing and knSALK sleeps (the cold half). The split falls exactly on the swap, because heat is a property of what you’re doing, not of the contract. PAPER TRAIL is I and III welded end to end — and the weld holds.

A no-swap variant exists: an operator who only wants the breach pay can stop after Phase 2 (P1+P2 banked on-complete), abandon the contract, and forfeit the on-resolve escrow — a different subset on the same machine. And a third phase (DELIVER the dossier to a buyer, a sanctioned FINANCIAL→PHYSICAL handoff) would extend the chain again, the same way.