BLACK LEDGER — Gameplay Specification

Forensic-Accounting Capability Module — KN-86 Deckline Cart 0x03

Design state: the tier stamps on this spec were set by the review loop documented in cartridge-premise-audit-2026-07.md; no person accepted the design. Josh’s premise there outranks anything below. v2.1 | 2026-07-18

Rewrite note (GWP-607, 2026-06-25): This supersedes the April-2026 v1.0 spec, which predated current canon (80×25 grid, C structs, CIPHER on the main grid, a monolithic cart). It is rebuilt onto the AmberCalc + Black Ledger v1 design (deleted 2026-07-29; recover from git history) (GWP-603) and the COLD LEDGER framing of gameplay-framework-walkthrough-black-ledger.md. The design doc is the authority; where this spec and a per-system doc / ADR differ, the per-system doc (and its ADR) wins. Hardware values are never restated here: see the parent canonical-spec.md Canonical Hardware Specification (128×75 cell ceiling on the 1024×600 panel, Rows 1–73 cart content with Row 0/74 firmware-owned, amber phosphor, OLED-exclusive CIPHER on the 256×64 CIPHER-LINE).

---

Tier 1 — Treatment

Stub (gate: draft). Added in the 2026-07-18 tier-ladder migration (GWP-726), distilled from §0 and the design doc (deleted 2026-07-29; recover from git history). It invents no design; it makes the treatment gap precise.

The hook

Black Ledger is the launch library’s financial-forensics cart. The operator is a freelance forensic accountant working a cold case: a generated shell-company ledger hides a conspiracy, and the job is to follow the money through the shell hierarchy and name the beneficiary. The gameplay is a verb-noun forensic grammar over that ledger; the minigame feel comes from five killer verbs and a dive/pop navigation core, with no real-time mini-game anywhere in the cart.

What the operator does

TRACE follows the money one hop. FLAG bookmarks a suspicious transaction. CROSS compares two flagged flows. CHAIN links flags into an evidence narrative, and the verdict names the beneficiary. The repeating decision: the move budget makes committing investigative attention scarce, so every TRACE, FLAG, and CROSS is a spend against the theory the operator is building.

Feel

Deliberative and cold. Browsing and theorizing are free; the case clock and the move budget squeeze the middle of a run. A short run chases one assertion gap to a hidden transfer; a long run closes a multi-link evidence chain and files a clean verdict. Pressure is internal in the cold case: nobody is tracing the operator back.

Feasibility verdict

• Reuses: the AmberCalc lens (the always-on columnar program), the shared mission board and economy, the objective machinery’s hold-and-clock pressure, and the canonical Lisp-primitive key semantics verbatim.
• New surface required: none at the operator layer. The engine seam for cart-issued contract declarations is tracked in Tier 3 (§1, §7).
• Red flags respected: no real-time input; the cold case raises no heat, so the defender never wakes, and that is the framework working as designed.

Open questions

• FORGE / DESTROY and the live-case heat path are deferred to the ICE BREAKER → Black Ledger campaign expansion (§10).
• The engineering-spike opens (assert-balance shape, query-language ownership, grid scale) are carried in Tier 3 (§10).

---

Tier 2 — Operator spec

3. The ledger model (the world Black Ledger generates)

• Accounts as colon-paths (Shell:Cayman:Holdings:042) → a navigable namespace where drilling a path is exploration. CAR descends, CDR moves between siblings, BACK ascends: canonical key meanings, unchanged.

• Double-entry zero-sum invariant → money only moves between accounts; an unexplained balance is a hidden posting. Elided-amount inference computes “the money must have gone here” as a derived hint; the engine supplies the lead, not the author.

• Register vs Balance: two lenses on one dataset, cycled by INFO (§4.6):

  • register — every movement + running total (the flow).
  • balance — the rolled-up account tree (the state).

  One query, two renderers; reads as two tools.

Implementation seam (GWP-726): Generation seeds — ledger-topology (the account tree + transfers), shell-depth (how many layers the conspiracy routes through), conspiracy-signature (the hidden ground-truth pattern the verdict scores against). Seeded by Universal Deck State so a board is reproducible from cipher_seed. The richer cart fields (account type, jurisdiction, balance history, per-transaction guilty/deletion status) live in the cart model, §5.

4. The five killer verbs → canonical Lisp keys (the gameplay)

In the order an investigator reaches for them. Each is a real list operation on the ledger tree, identical to its meaning in every other module; that identity is the justification for reusing each key (design doc §4.2, Appendix B).

Forensic verb	What it does	Key	Move cost
TYPE-COLUMN	turn a text column into currency / date → sortable / summable (“data comes alive”)	first-keystroke on column	free
TRACE (follow-the-register)	drill an account / follow a transfer to its destination; recurse the shell hierarchy	CAR	1 move
FLAG	bookmark a suspicious transaction (8 SRAM QUOTE slots)	QUOTE	1 move
CROSS / RECONCILE	compare two flagged flows (same amount? same scheme?) — binds to KEC is	EQ	1 move
CHAIN = CONS(FLAG, FLAG)	link flagged transactions into an evidence narrative (the COMPOSITE verb, literally the CONS key)	CONS	free (time-bound)
record / replay an audit pattern over N rows	”TRACE this shell path”; replay on another	LAMBDA / APPLY	free (mastery-gated)
submit verdict	judge scores flags vs hidden ground truth	EVAL	—
query / REPL	acct:, amt:>10000, date:, status: over the ledger	TERM	free

Implementation seam (ADR-0044): EQ binds KEC is. Per the parent canonical-spec.md Keys row and ADR-0044 §5, the EQ keycap art is unchanged but its authoring-insert binds KEC’s identity word is (KEC has no eq). The CROSS / RECONCILE verb is (is flow-a flow-b) over two flagged flows.

In the verb-partition taxonomy (verb-partition.md): FLAG and TRACE are CORE verbs; CHAIN is the COMPOSITE CONS(FLAG, FLAG). Here the COMPOSITE is literally built with the CONS key. Because it is grammar, the whole forensic surface is inspectable, scriptable, automatable: an operator can record a TRACE macro (LAMBDA / APPLY) or author a predicate at the REPL.

4.1 The query surface (the command line)

Typed at the REPL / nEmacs prompt (multi-tap T9 on the digit pad). A small hledger-style language filters every view identically:

acct:<path> · amt:>N / amt:<N · date:<range> · status:flagged|cleared|unmarked · not: · AND/OR-composable.

The two highest-signal forensic filters: amt:>N (every payment over a threshold) and status:unmarked (not-yet-reconciled = suspicious). TERM is always reachable (the capability-shapes rule: the console always overlays, even mid-capability).

Implementation seam (ADR-0044): KEC punctuation for the query language is reachable post-ADR-0044 (the KEC-complete layout).

4.2 Reconcile-by-assertion — the win mechanic

The single strongest forensic mechanic in the survey (beancount balance assertions). The operator obtains an external “true” figure (a seized statement, a recon fact from DOSSIER), asserts it against an account at a date, and the math breaks: the engine names which account, which date, by how much. The delta is the clue. The loop:

1. recon / obtain a true balance for Shell:Cayman:Holdings:042 at date D.
2. (assert-balance acct date amount) → mismatch → gap of ¤X surfaced.
3. TRACE postings between the last good assertion and the broken one to locate the hidden transfer.
4. reconstruct the deleted transaction (OBTAIN), FLAG it, CHAIN it.
5. cleared / pending state: investigation = turning unmarked rows into cleared as corroborating evidence accumulates: a built-in progress bar and a fair, solvable puzzle (double-entry strictness guarantees fraud leaves a detectable inconsistency).

Implementation seam (GWP-611): assert-balance’s exact FFI signature, and whether the “external true figure” comes from a recon fact or a mission-authored value, are open (design doc §10); finalize with the engineering spike. The mechanic is locked: assert → surfaced gap → the gap is the clue.

4.3 Pressure model

Move costs: CAR / QUOTE / EQ cost 1; CDR / CONS / INFO / query are free. Browsing and theorizing are free; committing investigative attention is the scarce resource. Budget→0 forces a verdict on the evidence so far. Exact budget magnitudes per threat are tuning (the shipped cart encodes a starting table to retune; §7).

Implementation seam (GWP-611): the signature “move-limited investigation” is not a new subsystem. The move budget and case clock are the objective model’s :hold-and-TTL machinery (mission-objectives.md §4): the engine evaluates :hold predicates each tick. The cart never polls.

4.4 Trackpoint

Aim the cursor at a cell / column and click to dive (VisiData’s two-cursor feel), complementing CAR / CDR. v0.1: single cursor, primary click.

Implementation seam (ADR-0035): ADR-0035 exposes cursor-position / on-trackpoint-move / on-trackpoint-click, clamped to content rows. Per-pointer differentiation deferred (ADR-0032 v2).

---

Tier 3 — Detailed design

0. What Black Ledger is now

Black Ledger is the launch library’s financial-forensics cart and the pure-grammar exemplar (capability-shapes.md): the gameplay is a verb-noun forensic grammar over a generated shell-company ledger, not an arcade loop. There is no real-time mini-game. The “minigame feel” comes from five killer verbs and a dive/pop navigation core (the design doc §1 (deleted 2026-07-29; recover from git history), fork 1).

Three things changed structurally from v1.0:

1. Black Ledger is a cart on top of a program. The tabular surface (rows, calculated columns, money-flow and ratio views, sort/filter) now belongs to the always-on first-party program AmberCalc (program #7, ADR-0042). The cart hands its world to AmberCalc and overlays the FORENSICS vocabulary on the returned surface. Carts enrich, never gate: eject Black Ledger and AmberCalc (and the bare :audit baseline) are still there. See §2.
2. The cart is blackledger.lsp: KEC Lisp source, tree-walked. C is runtime-only; this spec carries no C structs. The cell model is the Fe cart model. See §5.
3. v1 scope is a cold-case audit. ANALYZE + OBTAIN + OBSERVE only. FORGE / DESTROY and the live-case heat / knSALK path are deferred to the ICE BREAKER → Black Ledger campaign expansion. See §6, §10.

Design principle (project rule): every feature is justified by a gameplay-mechanic addition and reuses the canonical Lisp-primitive key semantics verbatim (CAR / CDR / CONS / QUOTE / EQ / EVAL / LAMBDA / APPLY / BACK / INFO). See Appendix B.

1. Mission Contributions & Capability Registration

(mission-contributions
  :verbs (ANALYZE OBSERVE OBTAIN)
  :affinities (FINANCIAL INFORMATION))

CAR-drilling shell hierarchies and scoring evidence chains satisfies ANALYZE; QUOTE-flagging suspicious transactions satisfies OBSERVE; reconstructing deleted transactions and surfacing the beneficiary satisfies OBTAIN (intelligence as recovered asset). Hot-swap partner for ICE BREAKER (DIGITAL → FINANCIAL is a sanctioned transition).

Black Ledger’s (cart-init) issues the Mission Control capability declaration:

(register-capabilities
  :module     :black-ledger
  :bit        0x04
  :provides   '(:financial-forensics :evidence-chain
                :shell-hierarchy-trace :verdict-construction)
  :affinities '(:financial :information)
  :seeds      '(ledger-topology shell-depth conspiracy-signature)
  :supersedes :audit                   ; per ADR-0030 — supersedes the System-tier baseline
  :threat-cap 5)                       ; cart-tier ceiling

Implementation seam (GWP-611): register-capabilities, defcontract-schema, and the goal-objective API (goal-complete / goal-reveal / goal-choose / goal-fail, :hold / TTL) are currently System-tier-only at the engine: the goal verbs amend ADR-0005 and the :objectives clause amends ADR-0006, both finalizing with the engineering spike (mission-objectives.md §6, §10). This spec describes the intent of these declarations as the cart will issue them; the cart-tier binding is a known seam, not yet shipped. Treat the Lisp forms below as design intent, not a current cart-callable surface.

2. The program / cart seam — AmberCalc is the lens, Black Ledger is the world

This is the spec’s central change and the thing the framework walkthrough §5 exists to prove. A program is a generic, always-on, content-free lens; a cart supplies the world the lens looks at, the verbs that act on it, and the verdict that ends it.

AmberCalc alone — program #7, always-on	+ Black Ledger — cart 0x03
a generic columnar spreadsheet: rows, calc columns, filter/sort, @row$col addressing, export to DOSSIER	the world the lens looks at — a generated shell-company ledger with a hidden conspiracy (ledger-topology, shell-depth, conspiracy-signature)
crunches any table; has no notion of fraud	the FORENSICS verbs — TRACE a transfer, FLAG a transaction, CROSS / RECONCILE two flows, CHAIN them into evidence
surfaces an anomaly only if you sort for it	case structure + a verdict — the anomalies mean something; the run resolves to a named beneficiary
no missions, no economy	the contract, payout, reputation, the cart’s forensic ladder; threat ceiling lifted from :audit’s 2 to the cart’s 5
the :audit baseline can hand it a flat transaction set	the cart supersedes :audit and never gates AmberCalc

2.1 The handoff — :world, not :payload

The generated ledger is large and live: the case the enrichment contract reserves for a :world handle (a pointer to the mission-data region), not a :payload snapshot blob. So Black Ledger launches AmberCalc as:

(launch-app :ambercalc
  :world   ledger-topology              ; handle to the mission-data region (the live ledger)
  :payload '(:view register :threat 3)) ; small params: initial view + scale

AmberCalc reads and navigates the world region live: a node Black Ledger reveals stays revealed; a TRACE that descends a shell path mutates no durable state. Consequence happens only through key emission: a finding is committed as a DOSSIER fact-node via the sanctioned (dossier-commit <key>) (§2.2), and the verdict is one sanctioned UDS write (§7). Nothing AmberCalc does to the region writes durable state directly.

The walkthrough’s shorthand (launch-app :ambercalc :payload ledger-dataset) is superseded by the :world-handle form above (design doc §3.6).

2.2 Export to DOSSIER — fact-node, not a free write

A “finding” is a DOSSIER fact-node committed through the sanctioned (dossier-commit <key>) path (dossier-data-model.md), never a raw DOSSIER write. A finding carries the canonical fields:

• :key — typed, addressable (e.g. acct:shell:caribbean-trust:beneficiary) — what gating queries.
• :value, :prov — (:mission … :via ambercalc :phase analyze).
• :conf — :rumored / :inferred / :verified by trace depth (a shell-link :inferred, a beneficiary :rumored until the trace confirms it).
• :links — typed edges: :routes-to, :owns, :contradicts.

The committed beneficiary becomes recon intel that pre-seeds a future ICE BREAKER breach of the beneficiary’s accounts: the cross-job knowledge loop.

5. The cart model (Lisp, not C)

Black Ledger is carts/carts/blackledger.lsp: KEC Lisp source tree-walked by the runtime. Cells are Fe records (sidecar-alist fields), not C structs; handlers are Fe lambdas registered per cell type. The five cell types and their canonical-key handlers:

Cell type	Role	Keys it handles
case-board	root: list of available cases (seeded by UDS)	CAR (accept selection) · CDR (cursor next) · INFO (detail) · EVAL (accept) · NIL (clear)
inv-case	a single case — objective graph + the ledger world handle	CAR (open ledger via AmberCalc) · INFO (cycle register↔balance) · EVAL (submit verdict) · BACK (board) · NIL (clear tab)
account	a colon-path node (holding / subsidiary / shell / offshore / front)	CAR (TRACE — drill, 1 move) · CDR (next sibling, free) · QUOTE (FLAG account, 1 move) · ATOM (leaf test — terminal vs routing) · BACK · NIL
transaction	a money movement between accounts	CAR (follow to destination) · CDR (next) · QUOTE (FLAG + bookmark, 1 move) · EQ (CROSS, 1 move, binds is) · CONS (CHAIN) · BACK · NIL
evidence	a player-built proof chain (via CONS)	CDR (next chain) · CONS (extend) · EVAL (submit chain) · BACK

Handler dispatch is the runtime’s tagged-union cell contract: a cart cell’s handler is a Lisp lambda reference; the move-budget check, FLAG / bookmark globals, and chain construction are Fe ((@ cell field) reads, (!@ cell field val) writes over the sidecar alist). The shipped blackledger.lsp is a reduced port (1 case / 1 account / 3 txns) that never touches AmberCalc or DOSSIER; a placeholder, not the design in this spec; the full case fans out to AmberCalc per §2 and commits findings per §2.2.

ATOM keeps its canonical leaf-test meaning: a terminal account (no child accounts: a cash endpoint / personal account / beneficiary) vs a routing intermediary (a shell or holding company that moves money onward). Free, information-only.

6. Recon & the cold-case mission arc

The recon canon (recon-mode.md) already answers “what phases / actions are recon”; the elegant part is the cold/live split: the same machine lights a different subset by job type.

• Cold case (v1 default): COLD LEDGER. Records are pulled, not stolen. A passive PROFILE over archived filings via RIPSAW (the org-recon program) → ≈0 heat → knSALK never wakes. Pressure is internal: the move budget + the case clock. There is no offense to track, so nobody hits back, and that is the framework working, not a hole (heat is a property of intrusive play; cold analysis raises none).
• Live case (deferred). Poke the live org / breach for fresh records → an active PROBE / RIPSAW pass raises heat → can summon knSALK like a netrun. Same shared system; the FORGE / DESTROY verbs live here. Out of v1 scope (§10).

Recon deposits typed DOSSIER fact-nodes (:conf rumored → inferred → verified) via the sanctioned dossier-commit; (dossier-has? <key>) gates or de-risks the case. A prior ICE BREAKER breach of the target pre-seeds the org tree: a banked :target profile means (dossier-has? org:glass-corp:topology) → true, so the org tree comes pre-seeded and an earlier job de-risks this one.

The forensic mission arc (FORENSICS verb-taxonomy: Acquisition → Triage → Analysis → Correlation → Output)

Phase	Verb	Action
0 · Board	—	seeded by Universal Deck State → accept → objective graph loads
1 · ACQUIRE	OBSERVE	recon: PROFILE archived filings (cold) via RIPSAW; bank shell-links + a beneficiary candidate → DOSSIER
2 · TRIAGE	ANALYZE	(launch-app :ambercalc :world ledger-topology); TYPE-COLUMN; frequency / sort / select to surface anomalies (round numbers, over-threshold, tax-haven dests)
3 · TRACE	ANALYZE	follow-the-register recursively through the shell hierarchy (CAR); CROSS-check pairs (EQ)
4 · CORRELATE / EXPOSE	OBTAIN	CHAIN flagged txns (CONS); reconcile-by-assertion to nail the gap; reconstruct deleted transactions from balance deltas
5 · VERDICT	OBTAIN → DELIVER	name the beneficiary; file → DELIVER to client → DOSSIER :verified node → one sanctioned UDS write (§7)

This covers the killer-verb list in one cart: identifying patterns (frequency / sort / select), acquiring information (recon → DOSSIER), extracting data (OBTAIN recover), with planting (FORGE / DELIVER-false) and deleting (DESTROY / cover-tracks) reserved for the live-case expansion.

7. Example mission template — COLD LEDGER

Implementation seam (GWP-611): defcontract-schema, register-capabilities, and the goal-objective API are System-tier-only at the engine today (§1). The forms below describe the COLD LEDGER contract’s intent: how the cart will declare it once the cart-tier binding lands. They are not currently cart-callable. The :ttl-range maps to the engine :hold / TTL machinery (§4.3), not bespoke cart code.

;; the contract template (ships in the cart's static-data block)
(defcontract-schema cold-ledger
  :class       ANALYSIS                       ; ANALYZE × FINANCIAL
  :required-capabilities (:financial-forensics :evidence-chain)
  :threat-range (1 . 5)
  :seeds       (ledger-topology shell-depth conspiracy-signature)
  :ttl-range   (move-budget . case-clock)     ; engine :hold/TTL, not cart code
  :payout-formula (scale (* base threat))
  :objectives
    (spine
      (goal P1 :map-shell-hierarchy  :primary :briefed (¤ 300 :on-complete))
      (goal P2 :name-the-beneficiary :primary :briefed (¤ 700 :on-resolve)
               :requires P1))
    (limbs                                     ; drawn per instance, seeded by UDS
      (goal O1 :clean-verdict :optional :briefed (rep 3 :on-resolve)
               :hold (and (<= 90 accuracy) (is false-flags 0)))
      (goal O2 :co-conspirator :optional :latent (¤ 400 :on-resolve)
               :reveal-at branching-shell)))

Objective panel as the player sees it (renders in AmberCalc’s content rows, 1–73):

○ P1  Map the shell hierarchy            ¤300        primary · briefed · on-complete
○ P2  Name the beneficiary (the verdict) ¤700        primary · briefed · :requires P1 · on-resolve
+ O1  Clean verdict — :hold (acc ≥ 90%, no false flags)  +3 REP   optional · on-resolve (escrow)
◌ O2  [latent] Co-conspirator            ¤400 +INTEL  optional · revealed @ branching shell

Mission succeeds when P1 + P2 are :done. Chasing O2 (a branching shell, two parents) burns the move budget and risks O1’s clean-verdict escrow: the structural “grab the bonus or bail?” tension.

Verdict & scoring

Keep the asymmetric scoring intent (precision over recall): a correct flag rewarded, a false flag penalized harder than a miss, plus time + move-efficiency bonuses and a chain-match bonus. Exact constants are a tuning detail: the shipped blackledger.lsp already encodes a base formula to retune; do not over-specify them here. The verdict writes once (one sanctioned UDS write per ADR-0040 §6): credit_balance += payout, reputation += the success delta, and the verdict + co-conspirator key land in DOSSIER as a :verified beneficiary fact-node; cipher_seed advances; phase_chain clears. The cart’s forensic ladder advances in its own save.

Legacy Logic_Index is retired. v1.0’s bespoke Logic_Index stat folds into the shared economy (economy-model.md): credits (the wallet) and reputation (standing) are the shared stats, and DOSSIER holds earned facts. The forensic ladder is cart-local content persisted in the cart’s own save. v1.0’s “Logic 40+ unlocks LAMBDA / APPLY” and “Logic 60+ cross-cart bonus” become ladder thresholds a cart author maps. No new shared stat is introduced.

8. Seven screens (redrawn for 128×75, content Rows 1–73)

The v1.0 spec drew seven sequential tab views inside an 80×25 box because the old grid couldn’t fit simultaneous panes. The 128-column / 73-content-row surface is wide enough to compose simultaneous panes, so the sequential-tab model is replaced by a two-pane forensic workbench (the dive/pop account tree on the left, the active view on the right), with INFO cycling the right pane’s lens (register ↔ balance) rather than swapping the whole screen. This is the deliberate design choice the task calls for: the expanded grid lets register and balance, or tree and detail, sit side by side instead of behind a tab. Where a screen is genuinely full-surface (the verdict), it uses the full width.

All wireframes obey the row contract: Row 0 = firmware status bar, Rows 1–73 = cart/AmberCalc content, Row 74 = firmware action bar (drawn here as the bracketed key-hint line). Cart art never draws Row 0 or Row 74. CIPHER is not on these screens; it renders OLED-exclusively (§9). Columns are abbreviated to ~96 of the 128 for legibility in this doc.

Screen 1 — Mission board (case selection)

Row 0  [firmware status bar]
Row 1  BLACK LEDGER · CASE BOARD                          REP 15   ¤5,420   MASTERY ▓▓▓░░
Row 2  ──────────────────────────────────────────────────────────────────────────────────
Row 3   AVAILABLE CONTRACTS                              │  PREVIEW · COLD LEDGER
Row 4   ────────────────────────────────────────────────│  ─────────────────────────────
Row 5   ✓ Basic Audit            done · 950 pts          │  Class   ANALYSIS (ANALYZE×FIN)
Row 6   ✓ Simple Reconstruction  done · 1,420 pts        │  Threat  3 / 5
Row 7  ▸○ COLD LEDGER            T3 · ¤1000 · ANALYSIS    │  Seeds   ledger-topology
Row 8   ○ Shell Network          T2 · ¤800               │          shell-depth
Row 9   ◆ Caribbean Conspiracy   T4 · LOCKED (mastery)   │          conspiracy-signature
Row 10  ────────────────────────────────────────────────│  Verb    follow the money
Row 11  TRAINING (repeatable · no rep)                   │  Pays    P1 ¤300 · P2 ¤700
Row 12   · Audit 101   · Reconstruction 101              │  +Bonus  O1 clean +3 REP
Row 13                                                   │          O2 co-conspirator ¤400
…
Row 73
Row 74 [ CAR accept · CDR browse · INFO detail · EVAL begin · SYS menu ]

Screen 2 — Case briefing → objective graph

Row 0  [firmware status bar]
Row 1  BLACK LEDGER · COLD LEDGER · BRIEFING                              T3 · ¤1000
Row 2  ──────────────────────────────────────────────────────────────────────────────────
Row 3   CLIENT BRIEF                                     │  OBJECTIVE GRAPH
Row 4   ────────────────────────────────────────────────│  ─────────────────────────────
Row 5   GLASS-CORP is skimming through a shell network.  │  ○ P1 Map the shell hierarchy
Row 6   Trace the skim, name the beneficiary, file the   │       ¤300 · on-complete
Row 7   verdict. Records are archived — a cold pull.     │  ○ P2 Name the beneficiary
Row 8                                                    │       ¤700 · requires P1
Row 9   PRESSURE  move budget + case clock (internal)    │  + O1 Clean verdict
Row 10  HEAT      cold case → ≈0 → knSALK dormant        │       :hold acc≥90 no-false
Row 11  RECON     RIPSAW PROFILE (archived filings)      │       +3 REP · escrow
Row 12  PRE-SEED  dossier-has? glass-corp:topology → T   │  ◌ O2 [latent] Co-conspirator
Row 13            (your earlier ICE BREAKER breach)      │       ¤400 +INTEL @ branch
…
Row 73
Row 74 [ CAR begin · INFO recon (RIPSAW) · BACK board · SYS cancel ]

Screen 3 — Forensic workbench · BALANCE lens (account tree | account detail)

Two simultaneous panes (the new grid’s payoff). Left: the colon-path account tree, the dive column. Right: the drilled account. INFO cycles the right lens to register (Screen 4).

Row 0  [firmware status bar]
Row 1  BLACK LEDGER · COLD LEDGER          CLOCK 28:15   MOVES car 9/30 quote 4/20 eq 2/8
Row 2  ──────────────────────────────────────────────────────────────────────────────────
Row 3   ACCOUNT TREE (balance lens)        │  ACCOUNT · Shell:Delaware:Nexus
Row 4   ──────────────────────────────────│  ─────────────────────────────────────────────
Row 5   ● GLASS-CORP        $8.5M  holding │  type   SHELL (Delaware, no real operations)
Row 6   ├─○ Pacific Div     $120K  legit   │  bal    $2.1M   beneficiary [UNKNOWN]
Row 7  ▸├─◇ Nexus Holdings  $2.1M  SHELL ⚑ │  asserted @02-01 $500K → @03-01 $2.1M
Row 8   ├─◇ Venerus         $50K   front   │  ┄ assert-balance gap: ¤30K @02-15 unexplained
Row 9   └─▲ OFFSHORE TIER   (3 accts)      │  postings:
Row 10     ├─ Caribbean Tr  $1.8M          │   ⚑ 03-10  OUT  -$2.0M → Caribbean Trust
Row 11     ├─ Cayman Fin    $1.6M          │     03-12  IN   +$300K ← GLASS-CORP (loop?)
Row 12     └─ Handler LLC   $1.5M          │     02-05  IN  +$1.5M ← GLASS-CORP (round)
Row 13                                     │     01-20  IN   +$500K ← GLASS-CORP
…
Row 73
Row 74 [ CAR trace(1) · CDR next · QUOTE flag(1) · EQ cross(1) · INFO register · BACK ]

Screen 4 — Forensic workbench · REGISTER lens (follow-the-register)

Same workbench, INFO-cycled right pane: hledger-style aregister: pin one account, each row names the counterparty (the recursive “follow the money” thread).

Row 0  [firmware status bar]
Row 1  BLACK LEDGER · COLD LEDGER          CLOCK 27:40   MOVES car 10/30 quote 4/20 eq 2/8
Row 2  ──────────────────────────────────────────────────────────────────────────────────
Row 3   QUERY ▸ amt:>100000 status:unmarked              │  REGISTER · pinned Nexus Holdings
Row 4   ──────────────────────────────────────────────────│  ───────────────────────────────
Row 5   matched 6 of 41 postings                         │  date    counterparty     amount   bal
Row 6   ───────────────────────────────────────────────  │  01-20   ← GLASS-CORP    +500K   500K
Row 7   ⚑ 03-10 Nexus → Caribbean    -2.0M  unmarked     │  02-05   ← GLASS-CORP   +1.5M   2.0M
Row 8   ⚑ 03-15 Caribbean → Cayman   -1.95M unmarked     │  03-10   → Caribbean Tr -2.0M     0M
Row 9     03-20 Cayman → Handler     -1.85M unmarked     │  03-12   ← GLASS-CORP    +300K   300K
Row 10    02-05 GLASS → Nexus        +1.5M  cleared      │  ┄ round-trip: out then back, net 300K
Row 11    01-15 GLASS → Pacific      -50K   cleared      │  ┄ amt:>N + status:unmarked = leads
Row 12  ───────────────────────────────────────────────  │
Row 13  CROSS (EQ) two flows to test same-scheme         │
…
Row 73
Row 74 [ CAR trace(1) · QUOTE flag(1) · EQ cross(1) · CONS chain · INFO balance · TERM query ]

Screen 5 — CROSS / RECONCILE result (EQ binds is)

EQ compares two flagged flows. This is a transient result pane over the right side of the workbench.

Row 0  [firmware status bar]
Row 1  BLACK LEDGER · CROSS / RECONCILE          (is flow-a flow-b)        EQ 1/8 left
Row 2  ──────────────────────────────────────────────────────────────────────────────────
Row 3   FLOW A  03-10  Nexus → Caribbean Trust   -$2.00M
Row 4   FLOW B  03-15  Caribbean → Cayman Finance -$1.95M
Row 5   ──────────────────────────────────────────────────────────────────────────────────
Row 6    amount        ✗  2.00M ≠ 1.95M   (5% shaved — fee signature)
Row 7    date          ✓  5 days apart (consistent holding window)
Row 8    counterparty  ✓  dest A == source B  (chain link)
Row 9    same scheme   ▶  LIKELY — sequential layering, 5% extracted per hop
Row 10  ──────────────────────────────────────────────────────────────────────────────────
Row 11   CONS these two into the evidence chain →  CHAIN = CONS(FLAG, FLAG)
…
Row 73
Row 74 [ CONS add-to-chain · CDR next-pair · CAR detail · BACK register ]

Screen 6 — Evidence chain (CHAIN = CONS(FLAG, FLAG)) + reconcile-by-assertion

Row 0  [firmware status bar]
Row 1  BLACK LEDGER · EVIDENCE CHAIN "GLASS skim"           links 4 · traced $2.3M
Row 2  ──────────────────────────────────────────────────────────────────────────────────
Row 3   CHAIN (CONS spine)                       │  RECONCILE-BY-ASSERTION
Row 4   ─────────────────────────────────────────│  ─────────────────────────────────────
Row 5   1 GLASS-CORP →2.3M→ Nexus      02-05      │  asserted Cayman @03-31 = $1.50M (seized)
Row 6   2 Nexus      →2.0M→ Caribbean  03-10  ⚑   │  ledger says               $1.62M
Row 7   3 Caribbean  →1.95M→ Cayman    03-15  ⚑   │  ─────────────────────────────────────
Row 8   4 Cayman     →1.85M→ Handler   03-20  ⚑   │  GAP  ¤120K  @ 03-18  unexplained
Row 9   ─────────────────────────────────────────│  → TRACE postings 03-15..03-31
Row 10  narrative  bribes layered through 3 shells│  → reconstruct the deleted transfer
Row 11             15% extracted, exit to Handler │  → FLAG it · CONS it into the chain
Row 12  beneficiary candidate  Handler [rumored]  │  the delta IS the clue
…
Row 73
Row 74 [ CONS extend · EVAL submit-verdict · CAR open-link · BACK workbench ]

Screen 7 — Verdict (full-surface; EVAL)

Row 0  [firmware status bar]
Row 1  BLACK LEDGER · COLD LEDGER · VERDICT
Row 2  ══════════════════════════════════════════════════════════════════════════════════
Row 3                          INVESTIGATION COMPLETE — VERDICT FILED
Row 4  ══════════════════════════════════════════════════════════════════════════════════
Row 5   beneficiary named   Handler LLC → R. HANDLER   (verified)
Row 6
Row 7   GOAL          OUTCOME                       REWARD
Row 8   ────────────────────────────────────────────────────────────────────────────────
Row 9   P1  shell hierarchy mapped     ✓ done       ¤300   (banked on-complete)
Row 10  P2  beneficiary named          ✓ done       ¤700   paid
Row 11  O1  clean verdict              ✗ forfeit    +3 REP forfeited (a false flag slipped in)
Row 12  O2  co-conspirator             ✓ done       ¤400 + INTEL paid (held up)
Row 13  ────────────────────────────────────────────────────────────────────────────────
Row 14  SETTLEMENT  ¤1400 · REP +success-delta · LADDER +threat-weighted
Row 15              DOSSIER ← :verified beneficiary fact-node (pre-seeds a future breach)
Row 16  precision over recall — false flag cost the clean-verdict escrow
…
Row 73
Row 74 [ EVAL accept · BACK board ]

9. CIPHER — OLED-exclusive (CIPHER-LINE 256×64)

Black Ledger’s CIPHER voice renders only on the CIPHER-LINE auxiliary OLED, never on the 128×75 main grid (per the parent canonical-spec.md spec-hygiene rule and ADR-0015). The main grid carries AmberCalc content + the firmware rows only. Every “audit note / forensic commentary / verdict line” below is the intent of a beat; the actual CIPHER-LINE rendering is clipped fragments per the voice heuristic (cipher-voice.md).

Voice: forensic auditor working past midnight: cold, observational, occasionally dry. Publisher is Bureau 9 Technical Services; the voice sounds like it has access to information it shouldn’t. More certain than most carts (the ledger is either balanced or it isn’t) and never urgent in a cold case (no adversary tracing the operator). Black Ledger is deliberative: the voice leans annotate and reflect, and earns its strongest editorial beat at the verdict.

Structurally important beats (preserved on CIPHER-LINE)

Beat	Intent	CIPHER-LINE fragment(s)
Anomaly detected	pattern deviates from peers	anomaly. paper-thin.
Round-trip found	money left and came back, net zero	round-trip.
Assertion gap surfaced	balance assertion broke; the delta is the clue	the math breaks. then 120k. unaccounted.
Evidence chain complete	chain closes, beneficiary identified	chain closes. then one name.
Cold case, no heat	nobody is tracing the operator (framework working)	the money keeps its own record. then it names the hand.
Verdict correct	conspiracy exposed, payout transferred	called it. then paid.
Verdict incorrect	theory rejected, partial payout	missed something.
Hot-swap invitation (to ICE BREAKER, live-case)	encrypted/live records require intrusion	ledger's encrypted. then need the other cart.

The full vocabulary pools, production fragments, mode-weight biases, and style deltas (:active-hack, :debrief, :cart-swap-lull) are an authoring contract carried in the cart’s CIPHER block, unchanged in intent from v1.0 and retargeted entirely to the OLED. Verdict beats that v1.0 narrated on the main verdict screen now render on CIPHER-LINE while Screen 7 shows the settlement table.

10. v1 scope, deferrals, and open questions

In v1 (cold case): ANALYZE + OBTAIN + OBSERVE. The five killer verbs, reconcile-by-assertion, the AmberCalc seam, RIPSAW cold recon → DOSSIER, the COLD LEDGER template, the verdict + sanctioned UDS write.

Deferred to the ICE BREAKER → Black Ledger campaign expansion (live case):

• FORGE (plant false records) and DESTROY (cover tracks) verbs.
• The live-case heat path: active PROBE / RIPSAW / breach raising heat, and knSALK summonable as in a netrun.
• The cross-cart Hot Swap that welds this trace onto a live breach (PAPER TRAIL).

Open (defer to implementation / engineering spike):

• assert-balance exact FFI signature + where the external “true figure” comes from (recon fact vs mission-authored) (§4.2).
• AmberCalc grid scale at 1× vs 2× for the dense transaction table; on-glass tuning.
• Whether the query language is a first-party AmberCalc program feature or a Black Ledger cart contribution (§4.1).
• TRACE-back (verb-partition.md §8 coverage gap; Black Ledger is a candidate home): a “follow the forged signature back” mission, likely live-case.
• The GWP-611 engine seam — lifting register-capabilities / defcontract-schema / the goal-objective API from System-tier-only to a cart-tier binding (§1, §7).

Appendix A — Mapping from the retired v1.0 spec

v1.0 concept	v2.0 disposition
80×25 grid, 7 sequential tab views	128×75; two-pane forensic workbench (§8); INFO cycles the lens, not the screen
C structs (CASE, ACCOUNT, TRANSACTION, EVIDENCE_CHAIN)	Fe cart cell model (§5); C is runtime-only
Monolithic cart owns the tabular/flow/ratio views	AmberCalc owns them; cart hands :world and overlays FORENSICS (§2)
CIPHER on the main verdict/feedback screens	OLED-exclusive CIPHER-LINE (§9)
Logic_Index stat + Logic-gated unlocks	retired → shared economy (credits / reputation / DOSSIER facts) + a cart-local forensic ladder; unlocks become ladder thresholds (§7)
Move budgets as bespoke consume_move C logic	objective-graph :hold / TTL — engine-evaluated, cart never polls (§4.3)
Recon / DOSSIER absent	RIPSAW cold recon → dossier-commit; dossier-has? gating (§2.2, §6)
Reconstruction-from-balance-delta as a standalone case type	folded into reconcile-by-assertion as the win mechanic (§4.2)
FORGE / DESTROY / live cover-up (Phase-2 cross-cart)	explicitly deferred to the live-case expansion (§10)

Appendix B — Canonical Lisp-primitive key semantics (reused verbatim)

CAR = descend into the head (drill account → transaction → detail) · CDR = next sibling (next account / transaction) · BACK = ascend (pop the nav stack) · QUOTE = bookmark by reference (8 SRAM slots) · EQ = compare two bookmarked elements (binds KEC is) · CONS = construct / combine (build the evidence chain) · NIL = clear / cancel (unflag) · ATOM = leaf test (terminal account vs routing intermediary) · EVAL = commit (submit verdict) · LAMBDA / APPLY = record / replay an audit macro · INFO = inspect / cycle register ↔ balance · TERM = REPL / query surface.

These meanings are identical to their use in every other module; that identity is the design justification for the mapping in §4.

Batch 10 mechanics to fold in

Mechanics from the Batch 10 vintage set that fit this cart’s forensics motif and fill gaps in it. Candidates for a future build or spec pass, aligned to the economy model (credits spend; reputation gates offers; a mission resolves as a small mystery whose facts lock into DOSSIER).

• Evidence under a clock, scheduled suspects, sequenced-disclosure verdict (from Corruption): the deferred live case (§6, §10) gains a timed mode where suspects act on a fixed schedule, the operator assembles proofs against the clock, and the verdict requires presenting the evidence in the correct order.
• Fund recovery (from System 15000): the verdict adds clawing the funds back on top of naming the beneficiary, a second OBTAIN resolved as the payout, where the live case’s heat clock (§6, §10) means a slower recovery lets more funds drain first.

---

Migration notes

Tier-ladder migration pass, 2026-07-18 (GWP-726), per documentation-standard.md:

• Content regrouped under tier headings; section numbers are preserved from v2.0 so existing cross-references (§0–§10, Appendices) keep resolving. They read out of ladder order across tiers by design: §3–§4 sit in Tier 2, §0–§2 and §5–§10 in Tier 3.
• The legacy status line (Status: Design (current canon)) retires in favor of the ladder header. Gates: T2/T3 approved (merged via GWP-607 PR review); T1 is a migration stub, gate draft.
• No hardware-value drift found: v2.0 was already on the 128×75 / Rows 1–73 / OLED-CIPHER canon.
• Impl is partial: the shipped blackledger.lsp is the reduced port described in §5 (1 case / 1 account / 3 txns, no AmberCalc or DOSSIER seam).
• The GWP-611 engine seam (System-tier-only register-capabilities / defcontract-schema / goal-objective API) remains open; flagged behind seam markers in §1, §4.3, §7.

Inspirations

Assigned by Josh in the kn86-inspo workbench. Full map: cart-inspiration-map.md.

Source	Category
Roro	terminal library
Bureaucracy (1987, Infocom / Z-machine)	text adventure
Corruption (1988, Magnetic Scrolls / Rainbird)	text adventure