BLACK LEDGER — Gameplay Specification
Engineering Blueprint — KN-86 Deckline Capability Module 0x03
Version 1.0 | April 2026 | Status: Engineering-Ready
CIPHER-LINE revision note (2026-04-24): All Cipher voice text in this spec — audit notes, forensic commentary, evidence-chain observations — renders on the CIPHER-LINE OLED, not the main 80×25 grid. Black Ledger is a cerebral module; its Cipher voice is colder and more editorial than ICE Breaker’s. Read any quoted full sentence as the intent of the beat; actual CIPHER-LINE rendering is clipped fragments per the voice heuristic. See the CIPHER-LINE Contributions section at the end. Canonical engine spec:
docs/software/runtime/cipher-voice.md.
Mission Contributions
Section titled “Mission Contributions”Mission Composition Grammar declaration — verb vocabulary, affinity tag set, and
mission-contributionsschema are defined indocs/plans/post-v0.1/2026-04-25-mission-composition-grammar.md§1–§3.
(mission-contributions :verbs (ANALYZE OBSERVE OBTAIN) :affinities (FINANCIAL INFORMATION))Black Ledger is the launch library’s primary FINANCIAL forensic cart. CAR-drilling shell hierarchies and scoring evidence chains satisfies ANALYZE; QUOTE-flagging suspicious transactions satisfies OBSERVE; reconstructing deleted transactions and surfacing the beneficiary satisfies OBTAIN (intelligence as recovered asset). Default biases. Hot-swap partner for ICE Breaker (DIGITAL → FINANCIAL is a sanctioned transition; addendum §2).
Capability Registration
Section titled “Capability Registration”Black Ledger’s (cart-init) issues the following Mission Control capability declaration (canonical authoring contract: ../design-bibles/launch-titles-capability.md §3, ADR-0028 + ADR-0030):
(register-capabilities :module :black-ledger :bit 0x03 :provides '(:financial-forensics :evidence-chain :shell-hierarchy-trace :verdict-construction) :affinities '(:financial :information) :seeds '(ledger-topology shell-depth conspiracy-signature) :supersedes :audit ; per ADR-0030 — supersedes the System-tier baseline :threat-cap 5) ; cart-tier ceilingRelationship to baseline
Section titled “Relationship to baseline”Black Ledger supersedes the System-tier :audit baseline (../../runtime/baselines/audit.md) per ADR-0030. While inserted, Black Ledger amplifies the forensic-trace domain — replacing AUDIT’s surface-level transaction inspection with full shell-hierarchy CAR-drilling, evidence-chain construction, and verdict scoring under move-limit pressure, and lifting the threat ceiling from AUDIT’s training cap of 2 up to the cart’s operations ceiling of 5. Eject the cart and the deck falls back to AUDIT’s bare trace loop. See ../../runtime/mission-control.md §2.3 (the supersedes mechanic) and §3.2.1 (threat-cap inheritance).
Design Philosophy
Section titled “Design Philosophy”BLACK LEDGER is not an accounting simulation. It is an investigative deduction engine — the operator’s mastery of lateral thinking on the Deckline, evolving from structured pattern-recognition contracts into full forensic conspiracy-solving. The core loop is SCAN-ASSESS-TRACE-EXPOSE: scan a financial ledger for structural anomalies, assess which transactions deviate from legitimate business operations, trace money through shell account hierarchies to their final beneficiary, expose the conspiracy by linking evidence chains.
Unlike NEONGRID’s embodied, somatic learning or ICE BREAKER’s tempo-driven decision-making, BLACK LEDGER demands abstract cognitive reasoning under resource constraints. The operator must hold a complex financial hierarchy in working memory, cross-reference amounts and dates, infer deleted transactions from balance deltas and counterparty evidence, construct theories that connect disparate facts, and submit a verdict before move limits expire.
BLACK LEDGER teaches the operator to recognize financial conspiracy patterns. It respects their intelligence — there are no hints, no hand-holding. Cases are presented as raw corporate data. The operator must extract meaning through investigation.
The signature mechanic is move-limited investigation. Each case grants a finite number of investigative actions (CAR drills into accounts, QUOTE flags, EQ comparisons, CONS evidence linkages). Moving efficiently — using pattern recognition and audio cues to identify suspicious entries without examining every transaction — becomes the core skill. Sound telegraphs fraud. Suspicious transactions have distinct microtonal signatures on Voice 2. An experienced operator can “hear” shell company activity before seeing it.
Capability Identity: Module 0x03. Published by Bureau 9 Technical Services (mysterious government forensic division). Hot-swap partner for ICE BREAKER: Corporate Espionage campaigns are ICE BREAKER Phase 1 (network intrusion) → BLACK LEDGER Phase 2 (financial audit of extracted data).
1. THE INVESTIGATION LOOP: ATOMIC UNIT OF PLAY
Section titled “1. THE INVESTIGATION LOOP: ATOMIC UNIT OF PLAY”A BLACK LEDGER cycle is slow — measured in minutes, not seconds. But the loop structure mirrors ICE BREAKER’s OODA in structure:
SCAN → ASSESS → TRACE → EXPOSE (and repeat, deepening).
The Cycle
Section titled “The Cycle”SCAN (2-5 minutes): Operator views the ledger case briefing and initial corporate hierarchy. Screen shows:
- Case objective (AUDIT, RECONSTRUCTION, FORENSIC TRACE, MONEY_LAUNDERING)
- Threat level (1-5, reflects corporate power and legal risk)
- Time budget (case duration in minutes)
- Move budget (number of CAR drills, QUOTE flags, EQ comparisons, CONS linkages allowed)
- Corporate structure (parent accounts, visible subsidiaries, shell company flags)
- Cipher voice contextual briefing (Bureau 9 summarizes the case)
Operator surveys the landscape, identifying obvious structural red flags (e.g., offshore shell companies at second level, missing beneficial owners). No investigation commitment yet—pure reconnaissance.
ASSESS (3-8 minutes): Operator drills into specific accounts (CAR key). For each account, they see:
- Account type (Holding Company, Subsidiary, Shell, Offshore, Front Company)
- Balance history (opening, current, recent changes)
- Transaction history (list of transfers in/out, with descriptions)
- Suspicious indicators (flagged by system: large transfers, tax-haven destinations, timing anomalies)
Operator uses QUOTE (bookmark key) to flag suspicious transactions. Each flag consumes one move from the move budget. Operator presses CDR to scroll through transactions within an account. This does NOT consume moves—browsing is free.
TRACE (5-15 minutes): Operator has identified suspicious money flows. They trace the money through the shell network using CAR to follow each transfer to its destination account. They build a mental map of the transaction sequence. They may use EQ to compare two flagged transactions (do they match amounts? are they part of the same scheme?). Each comparison consumes one move.
Operator may press LAMBDA to record a trace sequence (e.g., “follow money from Account A → B → C → D → Final”) and APPLY to replay it on other suspected paths. Macros are powerful but must be pre-planned.
EXPOSE (2-5 minutes): Operator has mapped the money trail and understood the conspiracy pattern. They use CONS (combination key) to construct an evidence chain — a linked set of flagged transactions that form a coherent narrative (bribe money enters parent company → routed through shells → exits to personal account).
When ready, operator presses EVAL to submit findings. The nOSh runtime’s judge persona evaluates the operator’s flagged transactions against a hidden ground truth. Verdict is returned: guilty count, false flags, accuracy percentage, time bonus, final score.
Move Budgets and Decision Pressure
Section titled “Move Budgets and Decision Pressure”Move budgets are the core skill pressure in BLACK LEDGER. They are finite and cannot be refilled during a run. Each action type has a cost:
- CAR (Account Drill): Consumes 1 move. Must be used strategically to explore only high-value accounts.
- QUOTE (Flag Transaction): Consumes 1 move. False flags are penalized harder than missed guilty transactions.
- EQ (Compare Transactions): Consumes 1 move. Powerful tool for pattern matching but expensive.
- CONS (Link Evidence): Free to use (theoretically unlimited evidence chains). But building chains uses time; time pressure is the constraint.
- CDR (Scroll in Account): FREE. Browsing within an account costs nothing.
- LAMBDA/APPLY (Record/Replay): Free for first macro recording; replaying free. Unlocked at Logic_Index 40+.
- INFO (Double-tap view cycling): Free. Cycling between Account Tree / Transaction List / Money Flow costs nothing.
Move budgets scale by threat level:
| Threat | Duration | CAR Budget | QUOTE Budget | EQ Budget | CONS Chains |
|---|---|---|---|---|---|
| 1 | 15 min | 20 | 15 | 5 | Unlimited |
| 2 | 25 min | 25 | 18 | 8 | Unlimited |
| 3 | 40 min | 30 | 20 | 10 | Unlimited |
| 4 | 60 min | 35 | 25 | 12 | Unlimited |
| 5 | 90 min | 40 | 30 | 15 | Unlimited |
An operator who explores every account exhausts their CAR budget before deep investigation begins. An operator who flags every suspicious-looking transaction exhausts QUOTE budget and incurs false-flag penalties. The strategic operator uses audio cues and pattern recognition to prioritize high-value CAR drills and QUOTE flags.
2. SYSTEM ONE: THE LEDGER HIERARCHY
Section titled “2. SYSTEM ONE: THE LEDGER HIERARCHY”The ledger is a tree structure of corporate financial accounts, strictly hierarchical. Parent accounts contain child accounts. Money flows downward through the hierarchy or sideways via transfers between accounts at the same level.
Topology and State
Section titled “Topology and State”Each ledger is procedurally generated at contract creation:
- Contract type: AUDIT, RECONSTRUCTION, FORENSIC_TRACE, SHELL_MAPPING, MONEY_LAUNDERING
- Corporate structure: 5-15 accounts arranged in 2-4 levels
- Transaction count: 20-80 total transfers
- Red herring ratio: 40-80% of visible transactions are legitimate, mixed with guilty transactions
- Hidden transactions: 20-40% of transactions are deleted (RECONSTRUCTION contracts expose this)
Each account is a cell with state:
- Account name: Text label (e.g., “Zenith Industries,” “Caribbean Trust”)
- Account type: Holding Company, Subsidiary, Shell, Offshore, Front Company (type affects transaction pattern expectations)
- Incorporation jurisdiction: USA (Delaware), Offshore (Cayman, BVI, Panama), Unknown
- Current balance: Net asset value
- Balance history: Opening, quarterly, current (3-5 snapshots)
- Transaction history: Array of transfers (date, amount, source, destination, description)
- Beneficial owner: Hidden ground truth (operator must infer)
- Suspicious flags: System-marked anomalies (large transfers, tax-haven destinations, timing clusters)
Each transaction is a cell with state:
- Transaction ID: Unique identifier (TXN-YYYY-MM-DD-NNN)
- Date: When the transfer occurred
- Amount: USD value
- Source account: Where money came from
- Destination account: Where money went
- Description: Business description (invoice, salary, quarterly dividend, transfer)
- Routing: Direct or via intermediaries
- Guilty status: Hidden ground truth (is this transaction part of the conspiracy?)
- Deletion status: Visible or redacted (for RECONSTRUCTION contracts)
Fog of Information: Incomplete Data
Section titled “Fog of Information: Incomplete Data”Operator does not see the full ledger at once. Ledger must be navigated account-by-account. Screen real estate limits display to ~5 transactions per account view. Operator must use CDR to scroll through full transaction history.
Deleted Transactions (RECONSTRUCTION contracts only): Some transactions are marked [REDACTED - TRANSACTION DELETED]. The operator must infer these from balance deltas:
- Account A had balance $1.0M on Date 1.
- Account A has balance $750K on Date 5.
- Visible transactions sum to $220K of outflows.
- Missing: $30K (1.0M - 0.75M - 0.22M). There was a hidden $30K transfer.
Operator reconstructs these using CONS (combination key) to construct a hypothetical transaction with amount and likely destination. The judge evaluates whether the reconstruction matches ground truth.
Navigation Model: Sequential Tab Views (80 columns × 25 rows Constraint)
Section titled “Navigation Model: Sequential Tab Views (80 columns × 25 rows Constraint)”BLACK LEDGER uses a sequential tab view architecture rather than true split-pane. Due to the 80 columns × 25 rows display constraint, information is presented in logical tabs rather than simultaneous panes:
View 1: Account Tree — Hierarchical view of accounts. Operator navigates CAR/CDR to select accounts. Visual indicators show account type (● = Holding, ○ = Subsidiary, ◇ = Shell, ▲ = Offshore).
View 2: Transaction List — All transactions for the selected account. Operator uses CDR within this view to scroll transactions. QUOTE marks transactions as suspicious.
View 3: Money Flow Diagram — Sankey-style visualization of all money flows in the case (accessible via INFO cycle).
View Cycling: Press INFO at CASE cell to cycle between views: Tree → Transactions → Money Flow → Tree. Within a view, CDR scrolls vertically, CAR drills deeper (Account → Transactions, Transaction → Destination Account, Node → Related Flows).
Future Enhancement (Multi-Display Device): If the device is expanded to 80×48 or has a split-screen capability, the architecture supports true split-pane layout with independent navigation in each pane.
3. SYSTEM TWO: INVESTIGATION TOOLS
Section titled “3. SYSTEM TWO: INVESTIGATION TOOLS”BLACK LEDGER’s forensic toolkit are the core investigative mechanics.
CAR: Drill Into Account
Section titled “CAR: Drill Into Account”Press CAR (left hand, top row) to descend into selected account. Shows:
- Account details (name, type, jurisdiction, balance)
- Last 5-10 transactions (scrollable with CDR)
- Suspicious indicators (system-highlighted anomalies)
- Balance history (opening → current)
Drilling into a suspicious account is a theory test: “Is this shell company hiding money?” The operator confirms or refutes by examining the account state.
Cost: 1 move from CAR budget. Each account can be visited multiple times, but each drill consumes a move.
CDR: Navigate and Scroll
Section titled “CDR: Navigate and Scroll”Context 1 (Account Tree Level): CDR at account-level moves to next sibling account (or previous, depending on direction). Free (no move cost).
Context 2 (Transaction List Level): CDR within transaction detail scrolls to next transaction in list. Free.
Context 3 (Evidence Chain Level): CDR within a CONS-constructed evidence chain moves to next linked transaction in the chain. Free.
Scrolling is unlimited and free. Drilling (CAR) has move cost. This incentivizes efficient browsing.
QUOTE: Flag Suspicious Transaction
Section titled “QUOTE: Flag Suspicious Transaction”Press QUOTE (left hand, top row) to mark a transaction as suspicious (or clear the flag). Flagged transactions are marked with ⚠️ on the display.
Cost: 1 move from QUOTE budget per flag.
Scoring Impact:
- Correct flag (guilty transaction): +200 points
- False flag (legitimate transaction): -50 points
- Missed guilty transaction: -100 points
The scoring is asymmetric: false flags are penalized less than missed guilty. This encourages aggressive flagging, but too many false flags compound (operator might flag 10 transactions to catch 7 guilty ones, netting +1400 - 150 = +1250, but move budget limits this strategy).
EQ: Compare Two Transactions
Section titled “EQ: Compare Two Transactions”Press EQ (left hand, top row) to enter comparison mode. Select first transaction with CAR/CDR, then press EQ to mark it. Select second transaction, press EQ again. Screen shows:
TRANSACTION COMPARISON═════════════════════════════════════════════════════════════
Transaction 1: TXN-01 (Nexus Inflow $1.5M on 02-05)Transaction 2: TXN-03 (Nexus Outflow $2.0M on 03-10)
MATCH ANALYSIS: Amount Match: NO ($1.5M ≠ $2.0M) Date Proximity: YES (33 days apart - consistent with holding period) Counterparty Link: POSSIBLE (both involve shells) Part of Same Scheme: LIKELY (inflow from parent, followed by outflow to offshore)Cost: 1 move from EQ budget per comparison.
EQ is powerful for identifying transaction chains but expensive. Experienced operators use EQ sparingly, relying instead on visual scanning and audio cues.
CONS: Link Evidence Into Chains
Section titled “CONS: Link Evidence Into Chains”Press CONS (left hand, top row) to construct an evidence chain. Operator selects multiple flagged transactions (using CAR/CDR navigation) and links them into a coherent narrative. Screen shows:
EVIDENCE CHAIN: "BRIBERY MONEY LAUNDRY"═════════════════════════════════════════════════════════════
Link 1: $2.3M enters Acme Corp (bribe origin) → 01-15Link 2: $2.3M exits Acme → Nexus Holdings (shell layer 1) → 01-20Link 3: $2.0M exits Nexus → Caribbean Trust (shell layer 2) → 03-10Link 4: $1.95M exits Caribbean → Cayman Finance (shell layer 3) → 03-15Link 5: $1.85M exits Cayman → Handler LLC (final recipient) → 03-20
CHAIN STATUS: Complete (5 links, tracing $2.3M to final beneficiary)NARRATIVE: Bribes enter legitimate company, routed through three shellsto obscure origin, exit to Handler personal account.Cost: Free (unlimited evidence chains can be constructed). Time is the constraint (chain construction uses time).
Scoring Impact: A well-constructed chain that matches the judge’s ground truth is worth 300-500 bonus points. Chains that don’t match (linking unrelated transactions) receive -100 penalty.
LAMBDA/APPLY: Macro Recording and Replay
Section titled “LAMBDA/APPLY: Macro Recording and Replay”Press LAMBDA (left hand, bottom row) to begin recording a trace sequence. Operator makes movements (CAR, CDR, QUOTE) for up to 20 actions. Press APPLY to stop recording.
The sequence is stored as a “macro” (e.g., “TRACE_MONEY_PATH_1”). Operator can press APPLY (left hand, bottom row) to replay the macro on a different starting account.
Cost: Free.
Unlock: Requires Logic_Index 40+. Introduced at CASE 3 (FORENSIC_TRACE).
Use Case: Operator traces money through a shell network (CAR, CAR, CAR, QUOTE, QUOTE, QUOTE across 6 accounts). They record this as a macro. Later, they suspect a second money trail. They press APPLY to replay the same navigational sequence on a different starting account, automatically drilling and flagging similar transactions.
Macros are powerful but require planning. A badly-recorded macro wastes time and moves when replayed.
INFO: View Cycling (3-Mode Toggle)
Section titled “INFO: View Cycling (3-Mode Toggle)”Press INFO (left hand, middle row) to cycle through three investigation views:
View 1: Transaction List (Default) — Shows transactions in selected account as a scrollable list. Best for examining individual transfers.
View 2: Account Tree (Hierarchical) — Shows full corporate structure, with account types and balance health indicators. Best for understanding overall structure and identifying suspicious accounts at a glance.
View 3: Money Flow Diagram (Sankey) — Shows visual representation of how money moves through the network. Accounts are nodes; transfers are directed edges with amounts. Best for seeing the big picture and identifying loops or unusual patterns.
Cost: Free (view switching costs nothing).
This is a powerful contextual tool. An operator who is drowning in transaction details can press INFO once to step back and see the full corporate structure, then press INFO again to return to detailed view.
4. SYSTEM THREE: CASE SCORING AND VERDICT
Section titled “4. SYSTEM THREE: CASE SCORING AND VERDICT”The judge (firmware persona) evaluates the operator’s flagged transactions against a hidden ground truth.
Verdict Calculation
Section titled “Verdict Calculation”BASE_SCORE = 500 + (100 × guilty_transactions_found) - (50 × false_flags) - (100 × missed_guilty_transactions)
TIME_BONUS = (time_remaining / case_duration)ACCURACY_BONUS = (correct_flags / total_flags) × 100MOVE_EFFICIENCY = (moves_used / moves_available) × 100
FINAL_SCORE = BASE_SCORE × (1 + TIME_BONUS) × (1 - ACCURACY_PENALTY) = BASE_SCORE × (1 + TIME_BONUS) × (ACCURACY_BONUS / 100)
REPUTATION_GAIN = floor(FINAL_SCORE / 500)CREDITS_EARNED = FINAL_SCOREExample Verdict
Section titled “Example Verdict”Operator on a Threat 3 case (40 min duration, 30 CAR moves, 20 QUOTE moves):
- Guilty transactions in ledger: 8
- Operator found: 7 correct, 2 false flags
- Guilty transactions missed: 1
- Time remaining: 12 minutes
- Moves used: 25 CAR, 18 QUOTE, 9 EQ
Calculation:
BASE = 500 + (100 × 7) - (50 × 2) - (100 × 1) = 500 + 700 - 100 - 100 = 1000TIME_BONUS = 12 / 40 = 0.30 (30% bonus)ACCURACY_PENALTY = 2 false flags / 9 total flags flagged = -22% accuracy hitFINAL = 1000 × 1.30 × 0.78 = 1014 pointsREPUTATION = floor(1014 / 500) = +2CREDITS = 1014 ¤Score is respectable but not perfect (false flags cost). Reputation gain is moderate.
Accuracy vs. Completeness Tradeoff
Section titled “Accuracy vs. Completeness Tradeoff”The scoring is designed to reward precision over recall. An operator who flags 5 out of 8 guilty transactions with 0 false flags scores higher than an operator who flags all 8 but includes 3 false positives.
This creates decision tension: Should I flag the borderline-suspicious transaction, or wait for more evidence? Experienced operators learn to trust their Pattern Recognition and audio cues rather than examining everything.
Move Limits as Time Pressure
Section titled “Move Limits as Time Pressure”Move limits are indirect time pressure. An operator with 15 minutes remaining and 5 CAR moves left must work very efficiently. They cannot explore every account. They must rely on:
- Audio cues (Voice 2 transaction tones telegraph suspicious transactions)
- Structural analysis (shells are obvious; follow the shells)
- Quick math (balance deltas reveal major flows without transaction-level drilling)
This creates the same decision pressure as ICE BREAKER’s tempo, but expressed through resource depletion rather than real-time threat acceleration.
5. SYSTEM FOUR: SOUND AS FORENSIC TOOL
Section titled “5. SYSTEM FOUR: SOUND AS FORENSIC TOOL”The YM2149 PSG is the fourth agent in BLACK LEDGER’s ecosystem. It is not background. It is real-time financial data.
Three Voices: Distinct Channels
Section titled “Three Voices: Distinct Channels”Voice 1: Investigation Theme (Emotional Texture)
Base frequency: Slow, minor-key chord progression (C minor → G minor → F minor) repeating every 8 beats. Initial BPM: 60 (slow, deliberate, meditative).
As time pressure increases (fewer than 10 minutes remaining), BPM accelerates: 90 BPM → 120 BPM in final minutes. Chord progressions become increasingly discordant (adding diminished chords, sus4 tensions). Visual is unchanged; audio tells the emotional story.
Operator learns: audio tempo = urgency. When Voice 1 is slow, investigation can be methodical. When Voice 1 accelerates, time is critical.
At case completion, Voice 1 resolves: successful case → major key resolution (satisfying). Failed case → minor key unresolved fade (unsatisfying).
Voice 2: Transaction Tone (Forensic Signature)
Each transaction type has a distinct pitch. Operator learns to auditorily scan transaction lists without reading:
- Legitimate operational transfer (salary, dividend, quarterly): C4 (calm, normal)
- Unusual but possibly legitimate (foreign vendor invoice, tax payment): D4 (neutral, questioning)
- Suspicious (round-number transfer, tax-haven destination): E4 (alert)
- Highly suspicious (deleted transaction, counterparty unknown, offshore layer): F#4 (alarm, dissonant)
As operator scrolls through a transaction list (CDR), each transaction plays a 200ms tone. An operator who listens learns: C, C, C, D, E, E, F#, C… = “there are suspicious transactions clustered in positions 4-6.”
This is auditory pattern matching. It is a learned skill. Experienced operators can scan a 30-transaction list in 90 seconds by ear, identifying the top 5 suspicious items without reading a single line.
Voice 3: Feedback and Verdict Tones
- QUOTE (flag transaction): Bright bell tone (G5, 100ms) + confirmation beep
- CONS (link evidence): Ascending harmonic stack (C4, E4, G4, stacked with 50ms overlap, 300ms total)
- EQ comparison match: Two-note major third (C4-E4, 200ms each)
- EQ comparison mismatch: Two-note diminished (C4-Eb4, 200ms each, dissonant)
- Correct finding submitted: Major key resolution (C major arpeggio, 1 second, deeply satisfying)
- False accusation submitted: Unresolved minor (C minor with suspended tone, 300ms, unsatisfying)
- Case complete (verdict swell): Multi-voice harmonic progression (Cm → Gm → F → Cm, 2 seconds, dramatic)
Voice 1: Multi-Dimensional Pressure Signaling (Time + Move Budget)
Section titled “Voice 1: Multi-Dimensional Pressure Signaling (Time + Move Budget)”Voice 1 (Investigation Theme) simultaneously encodes two pressures: time pressure and move budget depletion. This allows expert operators to gauge both constraints through audio alone.
TIME PRESSURE LAYER (Tempo and Harmony):
- Base tempo: 60 BPM (threat_level 1), accelerating to 120 BPM in final 10 minutes
- Harmonic progression: C min → G min → F min (repeating cycle)
- As time_remaining < 10 minutes: dissonant chords added (C min + Eb = tritone)
- Resolution: On case submission, harmony resolves to C major (success) or unresolved minor (failure)
MOVE BUDGET DEPLETION LAYER (Sub-Bass Drone): A subtle harmonic drone (sub-bass frequencies, 80-180 Hz) rises in pitch as the operator exhausts move budgets. This is independent of time pressure and creates simultaneous tension:
- CAR budget 90-100% remaining: drone at 80 Hz (imperceptible, deep)
- CAR budget 70-90% remaining: drone at 100 Hz (barely audible)
- CAR budget 40-70% remaining: drone at 120 Hz (noticeable, building tension)
- CAR budget 10-40% remaining: drone at 150 Hz (prominent, high urgency)
- CAR budget 0-10% remaining: drone at 180 Hz (very prominent, critical pressure)
QUOTE and EQ Budget Pressure (Voice 3 Envelope): The attack and release times of Voice 3 feedback tones (QUOTE bell, EQ comparison tones) become sharper as QUOTE and EQ budgets deplete:
- Budget >70% remaining: 100ms attack, 200ms release (smooth, gentle)
- Budget 30-70% remaining: 50ms attack, 100ms release (snappier)
- Budget <30% remaining: 10ms attack, 50ms release (sharp, percussive, stressful)
Expert Play Example: An experienced operator 30 minutes into a 45-minute case, with:
- 5 CAR moves remaining (of 30)
- 3 QUOTE moves remaining (of 10)
- 2 EQ moves remaining (of 8)
Hears:
- Voice 1 at 60 BPM (time is not yet critical, ~15 min remaining)
- Voice 1 drone at 140 Hz (CAR budget is tight, warning state)
- Voice 3 feedback tones with snappy 50ms attacks (QUOTE and EQ budgets are critical)
Interpretation: “I’m not under immediate time pressure, but I’m running dangerously low on investigation tools. I need to work efficiently and prioritize my remaining moves.”
This audio signature enables screen-off play and adds mechanical depth to proficiency progression.
Advanced Play: Auditory Scanning
Section titled “Advanced Play: Auditory Scanning”An expert BLACK LEDGER operator with 20+ completed cases can work with the screen dimmed or off, relying entirely on audio:
- Voice 1 tempo tells them case stress level
- Voice 2 pitches tell them which transactions are suspicious
- Voice 3 confirms flagging and verdict status
This is not a gimmick. It is an accessibility feature that becomes an advanced technique (cf. ICE BREAKER speedrunners using sound-only mode). An operator who internalizes the audio signatures can investigate faster and with less visual fatigue.
6. EMERGENT COLLISIONS
Section titled “6. EMERGENT COLLISIONS”The four systems collide: the corporate hierarchy, the money flows, the operator’s deductive reasoning, and the financial mystery itself.
The Red Herring Collision
Section titled “The Red Herring Collision”Operator spots a $5M transfer from subsidiary A to shell company B. The transfer is massive, the destination is offshore. It looks like money laundering. Operator flags it.
Later, operator traces the money further: shell company B is a legitimate subsidiary restructuring. The money was moved to B to isolate tax liability for a bad investment (legal, if ethically questionable). It is not money laundering.
Operator has incorrectly flagged a legitimate transaction. Judge penalizes with -50 points. Operator learns: appearance of suspicion ≠ actual wrongdoing. Good financial analysis requires hypothesis testing and follow-through, not assumption.
On subsequent cases, operator is more careful. They trace money to final destination before flagging. They cross-reference transaction purposes. They think deeper.
The Deletion Collision
Section titled “The Deletion Collision”Operator is reconstructing deleted transactions in a RECONSTRUCTION case. They infer: there was a $50K transfer on 02-15 to “External Vendor Account.”
But when they trace the ledger: External Vendor Account received $50K on 02-16 (not 02-15). The $50K transfer couldn’t have been on 02-15.
Operator’s reconstruction is wrong. They must re-examine balance deltas and construct a different theory. This teaches precision. Deleted transactions are puzzles. One misplaced piece breaks the whole solution.
The Shell Network Conspiracy Collision
Section titled “The Shell Network Conspiracy Collision”Operator has mapped 8 shell companies. They’ve traced money from A → B → C → D → E → F → G → H → Final Account. They believe they understand the conspiracy pattern.
But then they notice: Company D has two parent accounts (both B and C send money to it). The graph is not linear; it is branching. Operator has been thinking one-dimensionally (a straight line of transfers) when the actual structure is a network.
Operator must revise their mental model. They re-examine all connections, seeing the full topology. This teaches systems thinking: money laundering is not a simple pipeline. It is a complex, interconnected system designed to obscure the source.
The Time Pressure Collision
Section titled “The Time Pressure Collision”Operator is working a case with 15 minutes remaining. They’ve identified 6 of 8 guilty transactions. They know where the final 2 are (in a deep subsidiary account), but reaching them requires 4 more CAR drills.
They have 3 CAR moves left.
They can either:
- Spend 10 minutes carefully mapping the account hierarchy (high certainty, but they’ll run out of time). Risk: find guilty transactions but time out before submitting.
- Use pattern recognition and audio cues to guess (fast, but risky). Risk: might flag false positives.
They choose option 2. They flag two transactions based on Voice 2 tones. They submit with 2 minutes remaining. They correctly identify 1 of the final 2, but incorrectly flag 1 false positive.
Final score is lower than if they’d been more careful. They learn: speed is a risk factor. Expertise is knowing when to be fast (obvious red herring, obvious shell) and when to be slow (complex shell network, ambiguous transfers).
7. SESSION SHAPE: EMOTIONAL ARC
Section titled “7. SESSION SHAPE: EMOTIONAL ARC”BLACK LEDGER sessions are long and episodic. Threat 2 cases are 20-30 minutes. Threat 3 cases are 40-50 minutes. Threat 5 cases are 80-120 minutes.
The 45-Minute Threat 3 Investigator Case
Section titled “The 45-Minute Threat 3 Investigator Case”Operator with Reputation 20 selects a Threat 3 FORENSIC TRACE case.
Minutes 0-5: Briefing. Case brief appears:
CASE: "SHADOW HOLDINGS EMBEZZLEMENT"Threat: 3/5 (corporate sensitivity, legal exposure)Duration: 45 minutesObjective: Trace $2.3M in suspected bribes through shell network.Identify the final beneficiary and expose the conspiracy.Operator presses CAR to enter the investigation. They survey the corporate structure and identify Nexus Holdings (shell company) as an obvious entry point.
Minutes 5-15: Initial Assessment. Operator drills into Nexus Holdings (CAR) and sees a $2.3M inflow from parent company Acme Corp, followed by an immediate $2.0M outflow to Caribbean Trust. Red flags everywhere.
Operator presses QUOTE to flag these transactions (2 moves consumed). They press INFO to see the Money Flow diagram. They see the structure: legitimate company → shell → offshore → final account.
They are now confident these are guilty transactions. But they want to trace the full path.
Minutes 15-30: Deep Trace. Operator drills into Caribbean Trust (1 CAR move). They see the $2.0M inflow and a $1.95M outflow to Cayman Finance Corp (5% fee shaved). They flag the outflow (1 QUOTE move).
They continue drilling: Cayman Finance Corp → Handler LLC. More 5% fees shaved. They flag the Handler outflow (1 QUOTE move).
At 25 minutes in, operator has visited 4 accounts, flagged 3 guilty transactions, and identified the pattern. They have ~20 CAR moves left and ~15 QUOTE moves left. They feel confident.
Minutes 30-40: Theory Building. Operator presses CONS to construct an evidence chain: Acme Corp → Nexus → Caribbean → Cayman → Handler. They link the 3 flagged transactions into a narrative: “Bribes laundered through three shells, 15% fee extracted.”
The chain is complete. Operator understands the conspiracy.
Minutes 40-45: Final Verification and Submission. Operator presses INFO to re-examine the corporate tree and confirm there are no additional branches or accounts they missed. They spend 2 minutes doing a final scan.
Confident, they press EVAL to submit findings.
Verdict:
CASE: Shadow Holdings Embezzlement═════════════════════════════════════════════════════════════Guilty Transactions Found: 3/3 ✓False Flags: 0 ✓Accuracy: 100%Time Remaining: 5:17 / 45:00 (+11.7% time bonus)Move Efficiency: 5 CAR / 30 available (17% utilization) ✓
BASE SCORE: 500 + (100 × 3) = 800TIME BONUS: ×1.117 = 894ACCURACY: 100% (×1.0)
FINAL SCORE: 894 pointsREPUTATION GAIN: +1 (Reputation now 21)CREDITS GAINED: 894 ¤Operator is satisfied. A perfect case, solved efficiently. They feel competent.
The Failed Case
Section titled “The Failed Case”Operator starts a Threat 4 case (60 min duration, 35 CAR moves, 25 QUOTE moves).
By minute 40, they’ve explored 12 accounts and flagged 8 transactions. They’ve used 28 CAR moves and 18 QUOTE moves.
At minute 50, they realize their understanding is wrong. They’ve missed a critical shell company that was buried 3 levels deep in the hierarchy. The $3M they traced actually loops back to a parent company via an unexpected path.
They have 10 minutes remaining, 7 CAR moves left, 7 QUOTE moves left. They cannot explore the final accounts and verify their new theory.
They panic and submit with their original flagging (which was 60% correct).
Verdict:
Guilty Transactions Found: 5/9False Flags: 2Accuracy: 63% (5 correct, 2 false, 2 missed)Time Remaining: 0:45 / 60:00 (no time bonus)
BASE SCORE: 500 + (100 × 5) - (50 × 2) - (100 × 2) = 850ACCURACY PENALTY: 63%
FINAL SCORE: 850 × 0.63 = 535 pointsREPUTATION GAIN: +1 (minimal)CREDITS GAINED: 535 ¤Operator gained only 535 credits (expected ~1500 for a Threat 4 case). Reputation gain is minimal.
But the case was valuable. Operator learned:
- Deep hierarchies hide shells; must explore multiple levels
- Move budgets force prioritization; cannot explore everything
- Time pressure forces incomplete information decisions
On the next case, operator explores more strategically.
8. ONBOARDING: THE FIRST FIVE MINUTES
Section titled “8. ONBOARDING: THE FIRST FIVE MINUTES”There is no tutorial. BLACK LEDGER teaches through play.
Boot Sequence and Mission Board
Section titled “Boot Sequence and Mission Board”Operator powers on. Mission board appears:
MISSION BOARD — BLACK LEDGER CASES═════════════════════════════════════════════════════════════REPUTATION: 2 LOGIC_INDEX: 8 CREDITS: 950 ¤
CASE 1: BASIC AUDIT [COMPLETED ✓] (950 pts) Duration: 15 min | Rep Gain: +1 | Next available in 1:30
CASE 2: SIMPLE RECONSTRUCTION [AVAILABLE] Duration: 20 min | Rep Gain: +2 | Threat: 1 Objective: Reconstruct 2-3 deleted transactions
CASE 3: SHELL DETECTION 101 [AVAILABLE] Duration: 15 min | Rep Gain: +1 | Threat: 1 Objective: Identify all shell companies in a 7-account network
CASE 4: FORENSIC TRACE [LOCKED - Unlock at Rep 5] Duration: 40 min | Rep Gain: +3 | Threat: 3
[Additional cases locked until reputation reaches thresholds]Operator selects CASE 2 (SIMPLE RECONSTRUCTION).
First Reconstruction Case
Section titled “First Reconstruction Case”BLACK LEDGER // SIMPLE RECONSTRUCTION═════════════════════════════════════════════════════════════OBJECTIVE: Account balances don't match transaction history.Reconstruct the missing (deleted) transactions.
CORPORATE STRUCTURE: ├─ Parent Corp (Legitimate) └─ Shell Holdings (Suspicious)
Time Remaining: 20:00Move Budget: CAR 20 | QUOTE 15 | EQ 5
Cipher Voice: "You are an auditor reviewing an account wheresome transactions have been deleted. The balance changed, butthe transaction log is incomplete. Infer the deleted transfers."Operator presses CAR to enter Parent Corp account:
PARENT CORP ACCOUNT — RECONSTRUCTION PUZZLE═════════════════════════════════════════════════════════════
Opening Balance (01-01): $10,000,000Current Balance (03-31): $8,500,000Change: -$1,500,000
VISIBLE TRANSACTIONS: 01-15: Outflow -$500K to Shell Holdings 02-10: Outflow -$300K (salary payments, documented) 03-20: Outflow -$400K to Shell Holdings [Total visible outflow: $1,200K]
MISSING OUTFLOW: $300K (10M - 8.5M - 1.2M visible = 0.3M unaccounted)
RECONSTRUCTION PUZZLE: • There is a deleted transaction for $300K • When did it occur? (Date is redacted) • Where did it go? (Destination is redacted) • Why was it deleted? (Implies something worth hiding)
Cipher: "Use CONS to hypothesize a deleted transaction.Provide amount ($300K) and likely destination (Shell Holdings?).The judge will evaluate your theory."
[Press CONS to construct a hypothetical transaction]Operator presses CONS. A text input screen appears (using numpad for amount entry). Operator enters $300K and selects Shell Holdings as destination. They submit the hypothesis.
Judge evaluates:
RECONSTRUCTION EVALUATION═════════════════════════════════════════════════════════════Your hypothesis: $300K transfer to Shell Holdings
Actual deleted transaction: $300K transfer to Shell Holdingson 02-15
RESULT: ✓ CORRECT
Your reasoning: • Balance delta was $300K • Previous transfers to Shell Holdings suggest a pattern • $300K is a round amount consistent with quarterly transfer • Deletion suggests something was hidden (shell activity)
Logic Index gained: +3Operator completed the reconstruction. They learned: balance deltas reveal hidden transactions. Deleted transactions are puzzles with logical solutions.
9. PROFICIENCY METRIC: LOGIC_INDEX
Section titled “9. PROFICIENCY METRIC: LOGIC_INDEX”BLACK LEDGER introduces a Logic_Index stat (parallel to NEONGRID’s Proficiency).
Logic_Index represents: analytical reasoning, pattern recognition in financial data, ability to infer missing information from context, and comfort with ambiguity.
Measured 0-100. Increases through play:
| Action | Gain |
|---|---|
| Complete AUDIT case with 0 false flags | +2 |
| Complete AUDIT case with <20% false flag rate | +1 |
| Complete RECONSTRUCTION (all deletions inferred correctly) | +5 |
| Complete FORENSIC TRACE (beneficial owner identified) | +3 |
| Complete SHELL MAPPING (all shells identified, beneficiary found) | +4 |
| Complete case with >80% time bonus | +2 |
| Construct evidence chain that matches judge’s narrative | +3 |
At Logic_Index 40+, LAMBDA/APPLY macros unlock (advanced feature). At Logic_Index 60+, hidden cross-cartridge bonus unlocks: +15% payout in ICE BREAKER SABOTAGE contracts (operator can infer optimal destruction targets).
10. LINKED PLAY: ASYMMETRIC TWO-PLAYER AUDIT
Section titled “10. LINKED PLAY: ASYMMETRIC TWO-PLAYER AUDIT”BLACK LEDGER supports asymmetric cooperative mode:
Auditor vs. Analyst
Section titled “Auditor vs. Analyst”Auditor (P1): Navigates the ledger, makes decisions. Sees partial corporate structure (fog of war). Makes flags and constructs evidence chains.
Analyst (P2): Watches the full ledger (Analyst gets unlimited view of all accounts). Cannot directly control Auditor but can send LINK hints via a communication channel.
Example Flow:
- Auditor has traced money through 3 shells (Nexus → Caribbean → Cayman).
- Analyst, watching the full structure, sees there are 2 additional shells Auditor hasn’t discovered yet (Handler LLC and Cayman Private Trust).
- Analyst presses LINK and sends message: “Check Handler LLC’s sub-accounts for final destination.”
- Auditor receives hint and investigates, discovering the next layer.
Scoring: Both players share verdict. Success = both gain reputation and credits. Failure = both share penalty. This creates accountability and forces collaboration.
Cross-Cartridge Linked Play: Operator 1 plays ICE BREAKER Phase 1 (SABOTAGE contract on a financial system). Operator 2 plays BLACK LEDGER Phase 2 (audit the same company to cover tracks). The money flows extracted in Phase 1 must be concealed in Phase 2’s ledger.
11. CELL ARCHITECTURE
Section titled “11. CELL ARCHITECTURE”Every entity in BLACK LEDGER is a cell. Cells have fields and handler signatures for nOSh phase dispatch.
CASE_BOARD Cell (Mission Board / Contract Selection Root)
Section titled “CASE_BOARD Cell (Mission Board / Contract Selection Root)”The CASE_BOARD cell is the entry point to all investigations. It displays a list of available cases and allows the operator to select and accept a case. The mission board screen (Screen 1 in section 14) implements the CASE_BOARD interface.
typedef struct { uint8_t cursor_index; // Currently selected case (0-15) uint8_t case_count; // Number of available cases CASE *available_cases[16]; // Pointers to CASE structs uint16_t case_ids[16]; // Case IDs for reference uint8_t selected_case_index; // Index of case being previewed} CASE_BOARD;
/* Phase handlers */on_car(CASE_BOARD *this) { // Enter selected case: drill_into(available_cases[cursor_index]) // Advance phase: CASE_BOARD → CASE (root account of selected case) // Initialize move budgets for the selected case // Play transition tone (Voice 3: harmonic stack) // Cipher voice: "Case briefing loaded. You are an auditor. Investigate."}
on_cdr(CASE_BOARD *this, int direction) { // Move cursor to next/previous case in list // Wrap around at list boundaries // Play navigation tone (Voice 3: soft click) // Update display (case name, threat level, payout estimate)}
on_info(CASE_BOARD *this) { // Display detailed case information for selected case: // - Case name // - Threat level (1-5) // - Duration estimate (20 / 30 / 45 minutes) // - Account count // - Transaction count // - Payout estimate // - CAR budget, QUOTE budget, EQ budget // - Case description / objective // Play tone (soft confirmation)}
on_eval(CASE_BOARD *this) { // Accept case and begin investigation // Call on_car(this) to enter selected case}Integration with Phase Chain:
- Boot sequence: the nOSh runtime initializes CASE_BOARD from template list
- Operator navigates CASE_BOARD with CAR/CDR/INFO
- Operator presses EVAL or CAR to select case
- The nOSh runtime advances to CASE phase (root account of case)
- Case investigation begins (see CASE cell handlers below)
ACCOUNT Cell
Section titled “ACCOUNT Cell”typedef struct { uint16_t account_id; // Unique ID (0-255) char name[32]; // Account name uint8_t account_type; // Enum: HOLDING, SUBSIDIARY, SHELL, OFFSHORE, FRONT uint8_t jurisdiction; // Enum: USA_DELAWARE, CAYMAN, BVI, PANAMA, UNKNOWN uint32_t balance_current; // Current balance in cents (to avoid float) uint32_t balance_previous[3]; // Last 3 snapshots uint16_t transaction_count; // Number of transactions TRANSACTION *transactions[80]; // Array of pointers to transactions uint16_t parent_account_id; // Parent account (0xFFFF if none) uint16_t child_accounts[8]; // Child account IDs uint8_t child_count; // Number of children uint32_t suspicious_score; // System-calculated suspicion (0-1000) uint8_t flags; // Bitmask: flagged_by_operator, highlighted_by_system, etc.} ACCOUNT;
/* Phase handlers */on_car(ACCOUNT *this) { // Drill into account: display transactions, balance history, suspicious indicators // Advance phase to TRANSACTION_BROWSE}
on_cdr(ACCOUNT *this, int direction) { // Navigate to next sibling account // If at pane level, switch to transaction pane}
on_quote(ACCOUNT *this) { // Toggle account-level flag (mark account as suspected shell) // Play flag audio (Voice 3)}
on_eval(ACCOUNT *this) { // Submit this account's evaluation (is it a shell? is it legitimate?) // Trigger judge feedback}
on_info(ACCOUNT *this) { // Cycle view: Tree → Transactions → Money Flow}
on_atom(ACCOUNT *this) { // Test if account is a leaf (no child accounts) bool is_leaf = (this->child_count == 0);
if (is_leaf) { // Account has no children (terminal: operating account, personal account, or beneficiary) // This often indicates: beneficial owner, cash endpoint, or legitimate operating account // Play confirmation tone (Voice 3: bright bell, G5, 100ms) stdlib_sfx_confirm(); cipher_voice("This account has no outflows to child accounts. Terminal endpoint."); } else { // Account has children (routing: shell, holding company, or intermediary) // This indicates: money is routed through this account to subsidiaries // Play alert tone (Voice 3: warning chime, descending E4-C4, 200ms) stdlib_sfx_alert(); cipher_voice("This account routes money to child accounts. Intermediary node."); } // No move cost. Information-only action. // Used for shell detection and topology understanding.}TRANSACTION Cell
Section titled “TRANSACTION Cell”typedef struct { uint32_t transaction_id; // Unique ID uint16_t date; // Days since epoch (for compact storage) uint32_t amount; // USD amount in cents uint16_t source_account_id; // From account uint16_t dest_account_id; // To account char description[48]; // "Quarterly Transfer", "Invoice", etc. uint8_t routing_type; // Enum: DIRECT, VIA_INTERMEDIARY, DELETED uint16_t intermediary_account_id; // If routing is VIA_INTERMEDIARY uint8_t guilty_status; // Hidden: INNOCENT or GUILTY (judge only) uint8_t visible_status; // VISIBLE or REDACTED uint32_t audio_signature; // Tone index (C4=0, D4=1, E4=2, F#4=3) uint8_t flags; // Bitmask: flagged_by_operator, queued_for_comparison} TRANSACTION;
/* Phase handlers */on_car(TRANSACTION *this) { // Follow transaction to destination account // Advance phase to destination ACCOUNT}
on_cdr(TRANSACTION *this, int direction) { // Move to next transaction in list}
on_quote(TRANSACTION *this) { // Flag transaction as suspicious (or clear flag) // Play flag audio (bright bell tone) // Consume 1 QUOTE move}
on_eq(TRANSACTION *this, TRANSACTION *other) { // Compare this transaction to another // Display match analysis (amounts, dates, counterparties) // Play comparison audio (match = major third, mismatch = diminished) // Consume 1 EQ move}
on_info(TRANSACTION *this) { // Show detailed transaction view: // - Routing details // - Counterparty info // - Suspicious indicators // - Related transactions (other transfers from same source, to same dest)}EVIDENCE_CHAIN Cell (Constructed via CONS)
Section titled “EVIDENCE_CHAIN Cell (Constructed via CONS)”typedef struct { uint16_t chain_id; // Unique ID char narrative[256]; // Operator-entered narrative uint16_t transaction_ids[20]; // Linked transaction IDs uint16_t link_count; // Number of transactions in chain uint32_t total_amount; // Sum of all amounts in chain uint8_t chain_type; // Enum: SEQUENTIAL_FLOW, LOOP, SPLIT, CONVERGE uint8_t narrative_match; // Hidden: does chain match judge's conspiracy? (0-100)} EVIDENCE_CHAIN;
/* Phase handlers */on_cons(EVIDENCE_CHAIN *this, TRANSACTION *new_link) { // Add transaction to chain // Update chain type (detect flow pattern) // Play harmonic stack audio (evidence linking confirmed)}
on_cdr(EVIDENCE_CHAIN *this, int direction) { // Navigate to next linked transaction // Display link context (amount, date, source, dest)}
on_eval(EVIDENCE_CHAIN *this) { // Submit evidence chain // Judge evaluates narrative_match // If match >80%: +300 bonus points // If match <50%: -100 penalty}CASE Cell (Contract Root)
Section titled “CASE Cell (Contract Root)”typedef struct { uint16_t case_id; // Unique ID char case_name[64]; // "Shadow Holdings Embezzlement" uint8_t case_type; // Enum: AUDIT, RECONSTRUCTION, FORENSIC_TRACE, SHELL_MAPPING, MONEY_LAUNDERING uint8_t threat_level; // 1-5 uint16_t duration_seconds; // Time budget uint16_t time_remaining; // Real-time counter uint16_t car_budget; // CAR move allowance uint16_t car_used; // CAR moves consumed uint16_t quote_budget; // QUOTE move allowance uint16_t quote_used; // QUOTE moves consumed uint16_t eq_budget; // EQ move allowance uint16_t eq_used; // EQ moves consumed ACCOUNT *root_account; // Entry point (parent company) ACCOUNT *all_accounts[32]; // All accounts in case uint16_t account_count; TRANSACTION *all_transactions[128]; // All transactions uint16_t transaction_count; uint16_t guilty_transaction_count; // Hidden: true guilty count EVIDENCE_CHAIN *evidence_chains[8]; // Operator-constructed chains uint8_t verdict_submitted; // Case is complete uint32_t final_score; // Calculated at verdict int8_t reputation_gain; // +/- reputation} CASE;
/* Phase handlers */on_car(CASE *this) { // Enter case: display case briefing // Advance phase to root_account}
on_eval(CASE *this) { // Submit case // Judge evaluates all flagged transactions // Calculate score, reputation, credits // Display verdict screen}
on_back(CASE *this) { // Return to mission board}Cell Handler Dispatch (nOSh Runtime)
Section titled “Cell Handler Dispatch (nOSh Runtime)”The nOSh runtime maintains a phase chain (stack of active cells). When a key is pressed:
void dispatch_input(uint8_t key_code, SystemState *g_state) { CELL *current = g_state->phase_chain[g_state->phase_depth];
switch (key_code) { case KEY_CAR: if (current->on_car) current->on_car(current); break; case KEY_CDR: if (current->on_cdr) current->on_cdr(current, direction); break; case KEY_QUOTE: if (current->on_quote) current->on_quote(current); break; case KEY_EQ: if (current->on_eq) current->on_eq(current, target); break; case KEY_EVAL: if (current->on_eval) current->on_eval(current); break; // ... etc }}Cells push/pop themselves from the phase chain as the operator navigates. A cell’s handler determines what happens when a key is pressed.
12. KEY MAPPING TABLE
Section titled “12. KEY MAPPING TABLE”All 31 keys with per-cell behavior:
Left Hand (14 Function Keys)
Section titled “Left Hand (14 Function Keys)”| Key | Position | BLACK LEDGER Behavior | Cost |
|---|---|---|---|
| CAR | Top Row (1) | Drill into account - Show transactions, balance history, suspicious indicators | 1 CAR move |
| CDR | Top Row (2) | Navigate/Scroll - Next sibling account OR next transaction (context-dependent) | Free |
| CONS | Top Row (3) | Link Evidence - Construct or add to evidence chain connecting flagged transactions | Free |
| NIL | Top Row (4) | Clear/Unflag - Remove flag from current transaction or clear selection | Free |
| ATOM | Middle Row (1) | Test if Leaf - Determine if account has child accounts. Provides audio+visual confirmation of account type (shell vs. terminal). No move cost. | Free |
| EQ | Middle Row (2) | Compare Transactions - Select two transactions for analysis (amounts, dates, counterparties) | 1 EQ move |
| EVAL | Middle Row (3) | Submit/Confirm - Submit case verdict OR confirm entry in text input mode | Free (submit) |
| QUOTE | Middle Row (4) | Flag Suspicious - Mark transaction or account as suspicious | 1 QUOTE move |
| LAMBDA | Bottom Row (1) | Record Trace - Begin recording a navigational macro (CAR/CDR sequence) | Free (unlock at Logic 40+) |
| APPLY | Bottom Row (2) | Replay Trace - Execute a pre-recorded macro on current account | Free |
| BACK | Bottom Row (3) | Return/Exit - Go back to parent account or abort current action | Free |
| INFO | Bottom Row (4) | View Cycle - Cycle between Account Tree / Transaction List / Money Flow diagram | Free |
| LINK | Bottom Row (5) | Linked Audit - Initiate or communicate with partner (Auditor/Analyst mode) | Free |
| SYS | Bottom Row (6) | System Menu - Pause case, check stats, abort case, return to mission board | Free |
Right Hand (16 Numpad Keys)
Section titled “Right Hand (16 Numpad Keys)”Numpad is PURE NUMERIC input. No directional usage.
| Key | BLACK LEDGER Behavior | Cost |
|---|---|---|
| 0-9 | Numeric Entry - Enter account numbers, transaction amounts, search queries. Used in text input mode only. | Free |
| ENT (Enter) | Confirm Input - Submit text entry (e.g., account number search, deleted transaction hypothesis) | Free |
| + | Credit Filter - Filter transaction list to show only inflows (positive amount) | Free |
| - | Debit Filter - Filter transaction list to show only outflows (negative amount) | Free |
| × | Ratio Analysis - Analyze transactions by ratio (e.g., fees as % of transfer) | Free |
| ÷ | Reverse Lookup - Given an amount, search for transactions matching that amount | Free |
Text Input Pattern (for searching account numbers or reconstructing deleted transactions):
- Press CAR or CONS to initiate a search/hypothesis
- Numpad 0-9 to enter digits
- Numpad + or - to specify direction (inflow/outflow)
- ENT to confirm input
- System searches/evaluates
Example: Finding an account with ID 1847
(Operator is at ACCOUNT tree view)Press CAR → "Enter account ID to navigate"Numpad: 1 8 4 7Numpad: ENT(System navigates to account 1847)Example: Reconstructing a $300K deleted transfer
(Operator is in RECONSTRUCTION mode)Press CONS → "Hypothesize a transaction"Numpad: 3 0 0 0 0 0 (amount in dollars)Numpad: + (it was an outflow)Numpad: ENT → "Enter destination account ID"Numpad: 0 5 (Shell Holdings, account 5)Numpad: ENT(Judge evaluates hypothesis)13. MISSION TEMPLATE DEFINITIONS
Section titled “13. MISSION TEMPLATE DEFINITIONS”Four mission contract types with threat ranges and payout formulas:
Objective: Identify all guilty transactions in a corporate structure.
Structure: 1 parent company + 2-4 subsidiaries. Some subsidiaries are shells, some are legitimate.
Transaction Distribution: 40-60 visible transactions. 50-80% are innocent. 20-50% are guilty.
Red Herring Rate: High. Legitimate subsidiaries have large transfers (quarterly dividends, inter-subsidiary loans) that look suspicious.
Time Budget: 15-20 min (Threat 1), 25-35 min (Threat 2), 40-50 min (Threat 3)
Move Budget: CAR 20-35, QUOTE 15-25, EQ 5-10
Payout Formula:
Base = 500 + (100 × guilty_found) - (50 × false_flags) - (100 × missed_guilty)Time Bonus = (time_remaining / duration) × 0.3Accuracy = (guilty_found / total_guilty) × 100Final = Base × (1 + Time_Bonus) × (Accuracy / 100)Reputation = floor(Final / 500)Threat 1 Example: AUDIT of a 5-account structure (1 parent, 4 subsidiaries). 30 transactions. 6 guilty. Threat level 1/5.
Threat 3 Example: AUDIT of a 12-account structure (3 levels deep, including offshore shells). 60 transactions. 10 guilty, mixed with complex legitimate transfers. Threat level 3/5.
RECONSTRUCTION
Section titled “RECONSTRUCTION”Objective: Infer deleted transactions from balance deltas and counterparty evidence.
Structure: 3-5 accounts with incomplete transaction histories. Some transactions are marked [REDACTED].
Deletion Pattern: Each account has 1-3 deleted transactions. Operator must hypothesize amount and destination from context clues.
Time Budget: 20 min (Threat 1), 30 min (Threat 2), 45 min (Threat 3)
Move Budget: CAR 20-30, QUOTE 10-15, EQ 5-8
Reconstruction Scoring:
Base = 500 + (200 × correct_reconstruction) - (100 × wrong_reconstruction)Each correct deleted transaction hypothesis = +200 pointsEach incorrect hypothesis = -100 pointsThreat 2 Example: RECONSTRUCTION of a shell company account. Opening balance $1M. Current balance $400K. 4 visible transactions total $350K. Missing $250K (assumed multiple deleted transfers). Operator must infer 2-3 deleted transactions.
FORENSIC_TRACE
Section titled “FORENSIC_TRACE”Objective: Follow money from an entry point to a final beneficiary, tracing through multiple shells.
Structure: 5-10 accounts in a linear or branching flow. Each account is either legitimate or a shell. Money enters at parent company, moves through shells, exits to an unknown final account.
Conspiracy Type: Money laundering (bribes, embezzlement, illegal proceeds). Money enters as “legitimate” revenue, exits as laundered cash to personal account.
Time Budget: 40 min (Threat 2), 60 min (Threat 3), 90 min (Threat 4)
Move Budget: CAR 25-40, QUOTE 15-30, EQ 8-15
Beneficial Owner Discovery:
Bonus = 300 + (100 × depth_of_trace)If operator identifies final beneficiary (personal account holder): +50 reputation bonusThreat 3 Example: FORENSIC_TRACE of a $2.3M bribery scheme. Money enters Acme Corp (legitimate company), moves through Nexus Holdings (shell), then to Caribbean Trust (offshore), then to Cayman Finance Corp, then to Handler LLC, finally to Handler Personal Account. Operator must trace all 5 levels and name the beneficiary.
SHELL_MAPPING
Section titled “SHELL_MAPPING”Objective: Identify all shell companies in a corporate structure and map the full network.
Structure: 8-15 accounts. Some are legitimate (Holding Companies, Operating Subsidiaries), some are shells (no real business activity, high transfer-through rate).
Difficulty: Shells are disguised among legitimate subsidiaries. An operator must use pattern recognition to identify them: minimal transaction count, low variance in amounts, quick transfer-outs, offshore jurisdiction.
Time Budget: 30 min (Threat 2), 50 min (Threat 3), 80 min (Threat 4)
Move Budget: CAR 30-40, QUOTE 15-20, EQ 5-10
Shell Detection Scoring:
Base = 500 + (150 × shells_correctly_identified) - (100 × false_shell_identifications)Bonus = 300 (if all shells identified with 0 false positives)Threat 3 Example: SHELL_MAPPING of a 12-account corporate structure. True shells: 4 (Nexus Holdings, Caribbean Trust, Cayman Finance, Handler LLC). Legitimate: 8 (parent company, 3 operating divisions, 4 investment subsidiaries). Operator must flag all 4 shells without incorrectly flagging legitimate accounts.
14. DETAILED SCREEN LAYOUTS (ASCII WIREFRAMES)
Section titled “14. DETAILED SCREEN LAYOUTS (ASCII WIREFRAMES)”Screen 1: Mission Board / Case Selection
Section titled “Screen 1: Mission Board / Case Selection”╔════════════════════════════════════════════════════════════════════════════════╗║ BLACK LEDGER // MISSION BOARD ║║ REP: 15 LOGIC: 52 CREDITS: 5,420 ¤ ║╠════════════════════════════════════════════════════════════════════════════════╣║ ║║ AVAILABLE CASES: ║║ ║║ ✓ CASE 1: Basic Audit [COMPLETED] ║║ Best Score: 950 pts | Best Time: 12:34 ║║ ║║ ✓ CASE 2: Simple Reconstruction [COMPLETED] ║║ Best Score: 1,420 pts | Accuracy: 95% ║║ ║║ ○ CASE 3: Shell Network [AVAILABLE] Threat: 2 / 5 ║║ Duration: 25 min | Est. Payout: 800-1200 ¤ ║║ Eligible: Rep 10+ ✓ | Your Status: Not attempted ║║ ║║ ○ CASE 4: Money Laundering [AVAILABLE] Threat: 3 / 5 ║║ Duration: 40 min | Est. Payout: 1200-2000 ¤ ║║ Eligible: Rep 15+ ✓ | Your Status: 1st attempt (563 pts, 27 min) ║║ ║║ ◆ CASE 5: Caribbean Conspiracy [LOCKED] Threat: 4 / 5 ║║ Duration: 60 min | Est. Payout: 2000-3500 ¤ ║║ Unlock: Rep 20 (You have 15, need +5) ║║ ║║ [TRAINING CASES - Repeatable, no rep gain:] ║║ • Audit 101 (Shell detection basics) ║║ • Reconstruction 101 (Deleted transaction inference) ║║ • Money Trail Tracing ║║ ║║ CAR: Select case | CDR: Browse | INFO: Details | SYS: Menu ║║ ║╚════════════════════════════════════════════════════════════════════════════════╝Screen 2: Case Briefing
Section titled “Screen 2: Case Briefing”╔════════════════════════════════════════════════════════════════════════════════╗║ BLACK LEDGER // CASE BRIEFING ║╠════════════════════════════════════════════════════════════════════════════════╣║ ║║ CASE: "SHADOW HOLDINGS EMBEZZLEMENT" ║║ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ║║ ║║ Bureau 9 Intelligence Brief: ║║ ║║ "Corporate investigation into Zenith Industries. A whistleblower ║║ has alleged $2.3 million in bribes paid to company executives. ║║ The bribes were routed through shell companies to conceal origin. ║║ Your task: audit the corporate ledger and trace the money trail. ║║ Identify all guilty transactions. Name the final beneficiary." ║║ ║║ CASE TYPE: FORENSIC TRACE ║║ THREAT LEVEL: 3/5 (corporate sensitivity, legal exposure) ║║ DURATION: 45 minutes ║║ ║║ MOVE BUDGET: ║║ • CAR Drills: 30 available ║║ • QUOTE Flags: 20 available ║║ • EQ Comparisons: 10 available ║║ ║║ CORPORATE STRUCTURE: ║║ Parent: Zenith Industries (Holding Company, Legitimate Operations) ║║ Shells: Nexus Holdings, Caribbean Trust, Cayman Finance Corp ║║ Unknown: Final Beneficiary (to be identified) ║║ ║║ PAYOUT ESTIMATE: 1200-2000 ¤ (depends on accuracy and speed) ║║ REPUTATION GAIN: +3 (for perfect case) ║║ ║║ [Press CAR to begin investigation] ║║ [Press SYS to cancel case] ║║ ║╚════════════════════════════════════════════════════════════════════════════════╝Screen 3: Account Tree / Hierarchical View
Section titled “Screen 3: Account Tree / Hierarchical View”ROW 0: BLACK LEDGER > ACCOUNT TREE [TIME: 28:15 / 45:00] [LOGIC: 52] [REP: 15]ROW 1:ROW 2: CORPORATE STRUCTURE (Hierarchical View)ROW 3: ────────────────────────────────────────────────────────────────────────ROW 4:ROW 5: ├─ ● ZENITH INDUSTRIES (Holding Co.) Balance: $8.5M [OK] [Q: 1/20]ROW 6: │ └─ Legitimate holding company, parent entityROW 7: │ROW 8: ├─ + ● Pacific Division (Subsidiary) Balance: $120K [NORMAL]ROW 9: │ Last Transfer: -$50K (payroll, 03-10)ROW 10: │ROW 11: ├─ + ◇ Nexus Holdings (Shell) ⚠️ Balance: $2.1M [SHELL] [Q: 2/20]ROW 12: │ Last Transfer: -$2.0M (Caribbean, 03-10) [SUSPICIOUS]ROW 13: │ Status: RED FLAG (turnover ratio 8:1, shell behavior)ROW 14: │ROW 15: ├─ + ◇ Venerus Consulting (Front) Balance: $50K [SHELL]ROW 16: │ Last Transfer: -$10K (unknown, 02-15) [FLAGGED]ROW 17: │ROW 18: └─ + ▲ OFFSHORE TIER (Hidden) [3 accounts, cascading transfers]ROW 19: ├─ Caribbean Trust .............. Balance: $1.8MROW 20: ├─ Cayman Finance Corp ......... Balance: $1.6MROW 21: └─ Handler LLC ................. Balance: $1.5MROW 22:ROW 23: [CAR=drill_nexus] [CDR=next_account] [QUOTE=flag] [INFO=detail] [BACK]Screen 4: Transaction List (Detailed Account View)
Section titled “Screen 4: Transaction List (Detailed Account View)”ROW 0: BLACK LEDGER > ACCOUNT: NEXUS HOLDINGS [TIME: 28:45] [MOVES: 9/30]ROW 1:ROW 2: NEXUS HOLDINGS — SHELL COMPANY ACCOUNTROW 3: ────────────────────────────────────────────────────────────────────────ROW 4: Account Type: Shell (Delaware incorporation, no real operations)ROW 5: Jurisdiction: USA - Delaware | Beneficial Owner: [UNKNOWN]ROW 6: Current Balance: $2.1M | Status: Active (last transaction 03-10)ROW 7:ROW 8: BALANCE PROGRESSION:ROW 9: 01-01: $0K (opened) 02-01: $500K 03-01: $2.1M 03-10: $100KROW 10:ROW 11: RECENT TRANSACTIONS (scroll with CDR):ROW 12: ────────────────────────────────────────────────────────────────────────ROW 13: [>] 03-10: OUT -$2.0M → Caribbean Trust ⚠️ [FLAGGED by you]ROW 14: SUSPICIOUS: Immediate outflow after accumulation. 95% of balance.ROW 15:ROW 16: [ ] 03-12: IN +$300K from Zenith IndustriesROW 17: Note: Inflow AFTER outflow (possible loop to hide origin)ROW 18:ROW 19: [ ] 02-05: IN +$1.5M from Zenith IndustriesROW 20: SUSPICIOUS: Large round amount, parent to shellROW 21:ROW 22: [ ] 01-20: IN +$500K from Zenith IndustriesROW 23: [CDR=next] [QUOTE=flag_this] [EQ=compare] [CONS=chain] [BACK]Screen 5: Money Flow Diagram (Sankey Visualization)
Section titled “Screen 5: Money Flow Diagram (Sankey Visualization)”ROW 0: BLACK LEDGER > MONEY FLOW DIAGRAM [TIME: 30:00 / 45:00] [LOGIC: 52]ROW 1:ROW 2: CORPORATE MONEY FLOWS (All Transfers Visualized)ROW 3: ────────────────────────────────────────────────────────────────────────ROW 4:ROW 5: ZENITH INDUSTRIES ($8.5M balance)ROW 6: ├─ Flow OUT $500K ──→ Nexus HoldingsROW 7: ├─ Flow OUT $1.5M ──→ Nexus HoldingsROW 8: ├─ Flow OUT $300K ──→ Venerus ConsultingROW 9: └─ Flow OUT $50K ──→ Pacific Division (normal payroll)ROW 10:ROW 11: NEXUS HOLDINGS ($2.1M received, $2.0M out)ROW 12: ├─ Flow IN $2.0M ←── from Zenith Industries [ENTRY POINT]ROY 13: └─ Flow OUT $2.0M ──→ Caribbean Trust [KEY TRANSFER ⚠️]ROW 14:ROW 15: CARIBBEAN TRUST ($1.8M balance)ROW 16: ├─ Flow IN $2.0M ←── from Nexus HoldingsROW 17: └─ Flow OUT $1.95M ──→ Cayman Finance Corp [CONTINUED FLOW]ROW 18:ROW 19: CAYMAN FINANCE CORP ($1.6M balance)ROW 20: ├─ Flow IN $1.95M ←── from Caribbean TrustROW 21: └─ Flow OUT $1.85M ──→ Handler LLC [FINAL DESTINATION]ROW 22:ROW 23: [CAR=trace_path] [INFO=amounts] [CONS=build_chain] [BACK=tree]Screen 6: Evidence Chain Construction (CONS Mode)
Section titled “Screen 6: Evidence Chain Construction (CONS Mode)”ROW 0: BLACK LEDGER > EVIDENCE CHAIN [TIME: 35:15 / 45:00] [MOVES: 18/30]ROW 1:ROW 2: EVIDENCE CHAIN: "BRIBERY MONEY LAUNDRY"ROW 3: ────────────────────────────────────────────────────────────────────────ROW 4:ROW 5: Link 1: ENTRY POINTROW 6: $2.3M enters Zenith Industries (parent company)ROW 7: Date: 02-05 | Source: Unknown origin (bribe entry)ROW 8:ROW 9: Link 2: SHELL LAYER 1ROW 10: $2.3M → Nexus Holdings (Delaware shell)ROW 11: Date: 02-05 | Transfer type: Parent to shell (disguise)ROW 12:ROW 13: Link 3: SHELL LAYER 2ROW 14: $2.0M → Caribbean Trust (offshore shell)ROW 15: Date: 03-10 | Fee extracted: 5% (~$100K lost)ROW 16:ROW 17: Link 4: SHELL LAYER 3ROW 18: $1.95M → Cayman Finance Corp (second offshore)ROY 19: Date: 03-12 | Fee extracted: 5% (~$100K lost)ROW 20:ROW 21: Link 5: FINAL RECIPIENTROW 22: $1.85M → Handler LLC (final beneficiary account)ROW 23: [EVAL=submit_chain] [CDR=next_link] [QUOTE=mark_key] [BACK=transactions]Screen 7: Case Verdict / Scoring
Section titled “Screen 7: Case Verdict / Scoring”ROW 0: BLACK LEDGER > CASE VERDICT [MISSION COMPLETE]ROW 1:ROW 2: ╔════════════════════════════════════════════════════════════════╗ROW 3: ║ INVESTIGATION COMPLETE — VERDICT ║ROW 4: ╚════════════════════════════════════════════════════════════════╝ROW 5:ROW 6: CASE: "Shadow Holdings Embezzlement" (Threat 3 / 5)ROW 7: Duration: 40 minutes | Time Remaining: 4:45 / 45:00ROW 8:ROW 9: YOUR FINDINGS:ROW 10: Guilty Transactions Flagged: 3/3 ✓ (PERFECT)ROW 11: False Flags: 0/3 ✓ (PERFECT)ROW 12: Accuracy Rate: 100% (all flagged transactions matched guilt set)ROW 13: Evidence Chains Constructed: 1 (matched judge's narrative)ROW 14:ROW 15: SCORING BREAKDOWN:ROW 16: ─────────────────────────────────────────────────────────────────ROW 17: Base Score: 500 + (100 × 3 guilty) - 0 false flags = 800 ¤ROY 18: Time Bonus: ×1.11 (10.6% bonus for 4:45 remaining) = 888 ¤ROW 19: Accuracy Bonus: ×1.0 (100% = no penalty) = 888 ¤ROW 20: Chain Bonus: +300 ¤ (evidence narrative matched)ROW 21:ROW 22: FINAL SCORE: 1,188 CREDITS | REPUTATION GAIN: +2ROW 23: [EVAL=accept] [BACK=board]╚════════════════════════════════════════════════════════════════════════════════╝
### Screen 4: Transaction Detail (Single Transaction Deep View)╔════════════════════════════════════════════════════════════════════════════════╗ ║ BLACK LEDGER // TRANSACTION DETAIL TIME: 28:15 / 45:00 ║ ╠════════════════════════════════════════════════════════════════════════════════╣ ║ ║ ║ TRANSACTION ID: TXN-2088-03-10-001 ⚠️ [FLAGGED] ║ ║ ═════════════════════════════════════════════════════════════════════════════ ║ ║ ║ ║ Date: 2088-03-10 Time: 14:32:17 GMT ║ ║ From Account: Nexus Holdings (Shell Company, Delaware) ║ ║ To Account: Caribbean Trust (Offshore, Cayman Islands) ║ ║ Amount: $2,000,000.00 USD ║ ║ Description: “Quarterly Transfer” ║ ║ Routing: Direct Wire (SWIFT code: XXXXXX via London banking center) ║ ║ ║ ║ SUSPICIOUS INDICATORS: ║ ║ ⚠️ Large amount ($2M) unusual for this account ║ ║ ⚠️ Offshore destination (tax haven jurisdiction) ║ ║ ⚠️ No documented business purpose ║ ║ ⚠️ Timing suspicious (transfer 5 days after receiving $1.5M inflow) ║ ║ ⚠️ Shell company involved (both source and destination are shells) ║ ║ ║ ║ RELATED TRANSACTIONS (same source account, same destination): ║ ║ • TXN-2088-02-05-001: +$1.5M IN from Zenith Industries ║ ║ • TXN-2088-03-12-001: +$300K IN from Zenith Industries (after outflow) ║ ║ ║ ║ RELATED TRANSACTIONS (same destination account): ║ ║ • TXN-2088-03-15-001: -$1.95M OUT to Cayman Finance Corp (5% fee) ║ ║ ║ ║ COUNTERPARTY ANALYSIS: ║ ║ Source: Nexus Holdings ║ ║ • Incorporated: Delaware ║ ║ • Employees: Unknown (likely 0 - shell company signature) ║ ║ • Real Business Activity: None detected ║ ║ • History: Opened 01-01, transferred $2M out in first 3 months ║ ║ ║ ║ Destination: Caribbean Trust ║ ║ • Jurisdiction: Cayman Islands (known tax haven) ║ ║ • Purpose: Immediate transfer to Cayman Finance Corp ║ ║ • Beneficial Owner: Unknown (hidden trust structure) ║ ║ ║ ║ [CAR: Follow to destination] [QUOTE: Flag/Unflag] [EQ: Compare] ║ ║ [CDR: Next transaction] [INFO: Full context] [BACK: Account view] ║ ║ ║ ╚════════════════════════════════════════════════════════════════════════════════╝
### Screen 5: Comparison View (EQ Result)
ASCII wireframe showing side-by-side comparison of two transactions:╔════════════════════════════════════════════════════════════════════════════════╗ ║ BLACK LEDGER // TRANSACTION COMPARISON TIME: 28:15 / 45:00 ║ ║ EQ Moves: 2 remaining / 8 ║ ╠════════════════════════════════════════════════════════════════════════════════╣ ║ ║ ║ TRANSACTION 1 │ TRANSACTION 2 ║ ║ TXN-2088-01-20-001 │ TXN-2088-03-10-001 ║ ║ ───────────────────────────────────────┼─────────────────────────────────── ║ ║ Date: 2088-01-20 │ Date: 2088-03-10 ║ ║ Amount: $1,500,000 │ Amount: $2,000,000 ║ ║ From: Zenith Industries │ From: Nexus Holdings ║ ║ To: Nexus Holdings (Shell) │ To: Caribbean Trust (Cayman) ║ ║ Description: “Q1 Transfer” │ Description: “Quarterly Transfer” ║ ║ Status: FLAGGED │ Status: FLAGGED ║ ║ ║ ║ MATCH ANALYSIS: ║ ║ ───────────────────────────────────────────────────────────────────────── ║ ║ Amount Match … ✗ NO ($1.5M ≠ $2.0M) ║ ║ Date Proximity … ✓ YES (50 days apart, consistent with timing) ║ ║ Counterparty Link … ✓ YES (both routed through shells) ║ ║ Direction Match … ✓ YES (complementary inflow → outflow) ║ ║ Part of Same Scheme … LIKELY (sequential money laundering pattern) ║ ║ ║ ║ VERDICT: Transactions are likely part of a coordinated money laundering ║ ║ pipeline. Transaction 1 receives bribes into shell. Transaction 2 moves ║ ║ money onward to offshore account. Combined score: 87% conspiracy match. ║ ║ ║ ║ [CAR: Detail T1] [CDR: Next pair] [CONS: Add to chain] [BACK: Exit] ║ ║ ║ ╚════════════════════════════════════════════════════════════════════════════════╝
**Navigation (at TRANSACTION cell, EQ comparison active):**- CAR: Drill into source transaction for details- CDR: Cycle to next pair (if operator has flagged multiple transactions)- CONS: Add both transactions to an evidence chain- BACK: Return to transaction list
**Audio feedback:**- EQ match (80%+ similarity): Major third (C4-E4) with harmonic swell- EQ partial match (50-80% similarity): Neutral tone (E4 alone)- EQ mismatch (<50% similarity): Diminished chord (C4-Eb4, dissonant)
### Screen 6: Money Flow Diagram (Sankey View)
ASCII wireframe showing the complete money flow topology of the case. This is the "big picture" view, useful for understanding complex shell networks at a glance.╔════════════════════════════════════════════════════════════════════════════════╗ ║ BLACK LEDGER // MONEY FLOW DIAGRAM (SANKEY) TIME: 28:15 / 45:00 ║ ║ All Flows | Filter: +Inflows ↓ | Filter: -Outflows ↓ | Scale: All ║ ╠════════════════════════════════════════════════════════════════════════════════╣ ║ ║ ║ CASH FLOW TOPOLOGY (Width = Amount) ║ ║ ───────────────────────────────────────────────────────────────────────── ║ ║ ║ ║ ║ ║ ╔═══════════════╗ ║ ║ ║ ZENITH ║ Parent Corp: $10M revenue from legitimate ops ║ ║ ║ INDUSTRIES ║ ║ ║ ║ (Holding) ║ $2.3M suspicious internal transfers ║ ║ ╚═══════════════╝ ║ ║ │ ║ ║ ┌───────┼─────────────────┬────────────┐ ║ ║ │ │ │ │ ║ ║ $1.5M $500K $2.3M $5.7M (Dividends) ║ ║ │ │ │ │ ║ ║ ▼ ▼ ▼ ▼ ║ ║ ┌──────────┐ ┌──────────┐ ┌──────────────┐ ┌──────────────────┐ ║ ║ │NEXUS │ │PACIFIC │ │CARIBBEAN │ │BENIGN TRANSFER │ ║ ║ │HOLDINGS │ │DIVISION │ │TRUST │ │TO SHAREHOLDERS │ ║ ║ │(Shell)⚠️ │ │(Legit)✓ │ │(Cayman)⚠️ │ │(Clean)✓ │ ║ ║ └──────────┘ └──────────┘ └──────────────┘ └──────────────────┘ ║ ║ │ │ ║ ║ $2.0M (5% fee) $1.95M (5% fee) ║ ║ │ │ ║ ║ └──────────────────────────────┘ ║ ║ │ ║ ║ $1.85M ║ ║ │ ║ ║ ▼ ║ ║ ┌─────────────────────┐ ║ ║ │ CAYMAN FINANCE │ Offshore intermediary ║ ║ │ (Offshore)⚠️ │ $1.85M inflow - 5% fees ║ ║ │ │ $1.75M outflow planned ║ ║ └─────────────────────┘ ║ ║ │ ║ ║ $1.75M ║ ║ │ ║ ║ ▼ ║ ║ ┌─────────────────────┐ ║ ║ │ HANDLER LLC │ Front company (shell) ║ ║ │ (Front)⚠️ │ Final laundering stage ║ ║ │ │ $1.75M inflow ║ ║ └─────────────────────┘ ║ ║ │ ║ ║ $1.7M ║ ║ │ ║ ║ ▼ ║ ║ ┌─────────────────────┐ ║ ║ │ PERSONAL ACCOUNT │ Beneficial owner (identity unknown) ║ ║ │ [BENEFICIARY]⚠️⚠️ │ $1.7M final destination ║ ║ │ Hidden │ MONEY TRAIL ENDS HERE ║ ║ └─────────────────────┘ ║ ║ ║ ║ SUMMARY: ║ ║ ───────────────────────────────────────────────────────────────────────── ║ ║ Total inflow: $2.3M (from parent) Leakage: $600K (26%) in fees/transfers ║ ║ Total outflow: $1.7M (to beneficiary) ║ ║ Nodes examined: 6 Nodes flagged: 5 Shells detected: 4 ║ ║ Money laundering confidence: 94% ║ ║ ║ ║ [CAR: Drill node] [CDR: View stats] [QUOTE: Flag flow] [INFO: Accounts] ║ ║ [CONS: Add to chain] [BACK: Return to tree] ║ ║ ║ ╚════════════════════════════════════════════════════════════════════════════════╝
**Navigation (at CASE cell, Money Flow view active):**- CAR: Drill into a node (account) to see transactions- CDR: View summary statistics (total flows, shell count, risk score)- QUOTE: Flag a suspicious flow or connection- CONS: Add a flow path to evidence chain- BACK: Return to account tree view
**Visual Design:**- Line thickness = transaction amount (thicker lines = larger amounts)- ⚠️ icon = account flagged as suspicious- ✓ icon = account verified as legitimate- [BENEFICIARY] = Hidden beneficial owner (operator must reconstruct)
**Use Case:**The Money Flow Diagram is the "board view" of a case. Operators use it to:1. Understand overall topology before deep investigation2. Identify major flow paths and intermediaries3. Spot missing connections or gaps in the ledger4. Make strategic decisions about where to focus investigation5. Construct evidence chains based on visual flow patterns
### Screen 7: Verdict / Case Completion╔════════════════════════════════════════════════════════════════════════════════╗ ║ BLACK LEDGER // AUDIT VERDICT ║ ╠════════════════════════════════════════════════════════════════════════════════╣ ║ ║ ║ CASE: Shadow Holdings Embezzlement ║ ║ ═════════════════════════════════════════════════════════════════════════════ ║ ║ ║ ║ YOUR FINDINGS: ║ ║ Transactions Flagged: 4 ║ ║ Evidence Chains Constructed: 1 ║ ║ Beneficial Owner Identified: Handler (correctly) ║ ║ ║ ║ JUDGE EVALUATION: ║ ║ ✓ Nexus Inflow ($1.5M on 02-05) — CORRECT ║ ║ ✓ Nexus → Caribbean Transfer ($2.0M on 03-10) — CORRECT ║ ║ ✓ Caribbean → Cayman Transfer ($1.95M on 03-15) — CORRECT ║ ║ ○ Venerus Invoice ($10K on 02-15) — FALSE (legitimate vendor payment) ║ ║ ║ ║ CASE ANALYSIS: ║ ║ Guilty Transactions Found: 3 / 3 ✓ ║ ║ False Flags: 1 (cost: -50 points) ║ ║ Missed Guilty Transactions: 0 ║ ║ Accuracy: 75% (3 correct out of 4 flagged) ║ ║ ║ ║ SCORING: ║ ║ Base Score: 500 + (100 × 3) - (50 × 1) = 800 points ║ ║ Time Bonus: 5:15 remaining / 45:00 = +11.7% ║ ║ Accuracy Penalty: 75% accuracy = ×0.75 ║ ║ Final Score: 800 × 1.117 × 0.75 = 670 points ║ ║ ║ ║ REWARDS: ║ ║ Credits Earned: 670 ¤ ║ ║ Reputation Gain: +1 (now Reputation 16) ║ ║ Logic Index Gain: +2 (now Logic 54) ║ ║ ║ ║ FEEDBACK: ║ ║ “You correctly identified the money laundering pipeline. However, you ║ ║ flagged a legitimate vendor payment as suspicious. Better financial ║ ║ analysis would cross-reference invoice amounts with legitimate business ║ ║ operations. Overall: solid investigation with one analytical mistake.” ║ ║ ║ ║ CAREER PROGRESSION: ║ ║ Level: Auditor (Rep 15-19) ║ ║ Next Level: Investigator (Rep 20) ║ ║ Status: 1 reputation point needed for next level ║ ║ ║ ║ [Press CAR to return to mission board] ║ ║ [Press SYS to view case replay] ║ ║ ║ ╚════════════════════════════════════════════════════════════════════════════════╝
---
## 15. CROSS-MODULE INTEGRATION
### ICE BREAKER Phase 1 → BLACK LEDGER Phase 2 (Corporate Espionage Campaign)
**Scenario:** Operator is on ICE BREAKER SABOTAGE contract targeting a financial system.
**Phase 1 (ICE BREAKER, 20 minutes):**- Operator infiltrates corporate network- Uses tools to locate financial records- Extracts transaction data (via MIRROR tool)- Plants evidence eraser (via GHOST tool)- Escapes with financial intelligence
**Transition:** Operator is flagged for mandatory Phase 2 (BLACK LEDGER) if:- They extracted data from a financial system- They used SABOTAGE contract type- BLACK LEDGER is in cartridge history
**Phase 2 (BLACK LEDGER, 40 minutes):**- The extracted transaction data is automatically loaded as a BLACK LEDGER case- The case objective is: "Audit the damage trail. Cover the tracks. Identify which transactions were affected by the sabotage."- The operator must: 1. Identify which transactions were altered/deleted by the sabotage 2. Reconstruct the original transaction data (RECONSTRUCTION mechanic) 3. Flag evidence of tampering so it can be erased later (post-audit cover-up)
**Scoring Integration:**- Phase 1 success (high extraction payout) → Phase 2 case difficulty increases (more complex financial structure to audit)- Phase 2 accuracy bonus (successful cover-up) → Credits earned are applied to Phase 1 contract's final payout
**Example Mission Chain:**CAMPAIGN: “FINANCIAL SABOTAGE” Phase 1: ICE BREAKER - Infiltrate bank network, extract account data Phase 2: BLACK LEDGER - Audit the extraction data, erase evidence of tampering Combined Payout: 3000-5000 ¤ (if both phases succeed) Combined Rep Gain: +5 (for successful 2-phase operation)
### Cross-Cartridge Proficiency Bonuses
**NEONGRID Proficiency → BLACK LEDGER Speed Bonus:**- Operator with NEONGRID Proficiency 60+ gains +25% navigation speed in BLACK LEDGER account tree- Pattern recognition from NEONGRID spatial puzzles transfers to financial pattern recognition- Operator can navigate account hierarchies 25% faster (shorter CAR drill time)
**BLACK LEDGER Logic_Index → ICE BREAKER Payout Bonus:**- Operator with Logic_Index 60+ gains +15% payout for ICE BREAKER SABOTAGE contracts- Financial deduction skills transfer to network sabotage planning (operator understands financial system architecture better)- Can identify high-value targets for sabotage more efficiently
**Cipher Voice Integration:**- BLACK LEDGER Cipher voice is the same persona across all campaigns- As operator progresses, Cipher's briefing style evolves: verbose for low-reputation, terse for high-reputation- At high Logic_Index (70+), Cipher provides "investigator tips" in case briefings (e.g., "Shell companies have low transaction variance. Listen for that pattern.")
---
## 16. IMPLEMENTATION NOTES
### Move Budget Management (Runtime)
```ctypedef struct { uint16_t car_budget; uint16_t car_used; uint16_t quote_budget; uint16_t quote_used; uint16_t eq_budget; uint16_t eq_used;} MoveBudget;
void consume_move(MoveBudget *budget, uint8_t move_type) { switch (move_type) { case MOVE_CAR: if (budget->car_used >= budget->car_budget) { cipher_voice("CAR moves exhausted. Switch to pattern recognition."); return false; // Action blocked } budget->car_used++; break; case MOVE_QUOTE: if (budget->quote_used >= budget->quote_budget) { cipher_voice("QUOTE budget exceeded. No more flags allowed."); return false; } budget->quote_used++; break; case MOVE_EQ: if (budget->eq_used >= budget->eq_budget) { cipher_voice("EQ budget exhausted. Rely on visual analysis."); return false; } budget->eq_used++; break; } return true;}Verdict Calculation (Firmware Logic)
Section titled “Verdict Calculation (Firmware Logic)”uint32_t calculate_verdict(CASE *case_obj) { uint32_t guilty_found = count_correctly_flagged(case_obj); uint32_t false_flags = count_false_flags(case_obj); uint32_t missed_guilty = case_obj->guilty_transaction_count - guilty_found;
uint32_t base = 500 + (100 * guilty_found) - (50 * false_flags) - (100 * missed_guilty);
float time_remaining_ratio = (float)case_obj->time_remaining / case_obj->duration_seconds; float time_bonus = time_remaining_ratio * 0.3; // Max 30% bonus
uint32_t accuracy = (guilty_found * 100) / (guilty_found + false_flags); float accuracy_multiplier = accuracy / 100.0;
uint32_t final_score = (uint32_t)(base * (1.0 + time_bonus) * accuracy_multiplier);
int8_t reputation_gain = final_score / 500;
return final_score;}Audio Signature Generation
Section titled “Audio Signature Generation”Voice 2 transaction tones are determined at ledger generation:
uint8_t get_transaction_tone(TRANSACTION *txn) { if (txn->guilty_status == INNOCENT) { // Legitimate transfer: C4 (calm) if (is_normal_operational_transfer(txn)) return TONE_C4; // Unusual but possible: D4 (questioning) if (is_unusual_but_legit(txn)) return TONE_D4; } else { // Suspicious: E4 (alert) if (is_mildly_suspicious(txn)) return TONE_E4; // Highly suspicious: F#4 (alarm, dissonant) if (is_highly_suspicious(txn)) return TONE_F_SHARP_4; } return TONE_C4; // Default}Evidence Chain Narrative Matching
Section titled “Evidence Chain Narrative Matching”Judge’s ground truth is a hidden narrative (e.g., “Bribes laundered through 3 shells to personal account”). Operator’s evidence chain is evaluated:
uint8_t evaluate_narrative_match(EVIDENCE_CHAIN *operator_chain, char *judge_narrative) { // Parse operator's narrative // Compare transaction sequence to judge's narrative // Calculate match percentage (0-100)
uint8_t match_score = 0;
// Check if all guilty transactions are in chain if (guilty_count_in_chain == total_guilty_count) { match_score += 40; } else { match_score += (guilty_count_in_chain * 40) / total_guilty_count; }
// Check if chain sequence is logical (money flows in correct order) if (is_chronological_order(operator_chain)) { match_score += 30; }
// Check if beneficial owner is correctly identified if (final_account_id == judge_beneficiary) { match_score += 30; }
return match_score;}This specification is complete and engineering-ready. All sections contain sufficient detail for a C programmer implementing on the KN-86 Deckline platform.
CIPHER-LINE Contributions
Section titled “CIPHER-LINE Contributions”Black Ledger’s voice: forensic auditor working past midnight. Cold, observational, occasionally dry. Publisher is Bureau 9 Technical Services — the voice sounds like it has access to information it shouldn’t.
Vocabulary Pools
Section titled “Vocabulary Pools”(:subject "transaction" "subsidiary" "shell" "audit" "ledger" "entry" "counterparty" "beneficiary" "flow" "structure" "wire" "remittance")(:object "paper" "chain" "signature" "account" "pattern" "round-trip" "layering" "shell")(:location "ledger" "quarter" "jurisdiction" "bank" "column" "period" "filing")(:verb-present "moves" "settles" "clears" "matches" "loops" "disappears" "reconciles")(:verb-past-participle "moved" "cleared" "reconciled" "hidden" "layered" "matched" "disappeared")(:memory-keyword "paper trail" "shell" "audit" "round-trip" "jurisdiction" "quarter-end")(:affect-word "cold" "thin" "clean" "ragged" "paper-thin" "deep")Production Fragments
Section titled “Production Fragments”(:mode-observe (3 (:subject) ". " (:blackledger/amount-qualifier) ".") (2 (:verb-past-participle) " on " (:location) ".") (1 "match."))
(:mode-annotate (3 "paper trail. " (:affect-word) ".") (2 "this shell again.") (1 "round-trip.") (1 "too clean."))
(:mode-reflect (3 "same counterparty. " (:memory-fragment)) (2 "this jurisdiction. " (:memory-fragment)) (1 "paper trail. like the q3 filing."))
(:mode-drift (2 "the q3 filing nobody signed.") (1 "the bearer certificate.") (1 "seventeen shells. one beneficiary."))
(:blackledger/amount-qualifier (3 "small.") (2 "round.") (2 "paper-thin.") (1 "cosmetic."))
:event-types ((:type :anomaly-found :affect (:anomalous)) (:type :match-confirmed :affect (:significant)) (:type :shell-traced :affect (:routine)) (:type :evidence-chain-complete :affect (:significant)) (:type :verdict-submitted :affect (:significant)))Mode-Weight Biases
Section titled “Mode-Weight Biases”| Beat | observe | annotate | reflect | drift | silent |
|---|---|---|---|---|---|
:mission-brief | +0.05 | +0.05 | — | — | — |
:active-hack (investigation) | — | +0.10 | +0.05 | — | — |
:phase-transition | — | — | +0.15 | — | — |
:debrief (verdict) | — | +0.15 | +0.10 | — | — |
Rationale. Black Ledger is deliberative. The voice leans toward annotate and reflect — the auditor pauses, connects, editorializes. At verdict, the voice earns its strongest editorial beat.
Style Deltas
Section titled “Style Deltas”((:active-hack (:terseness +24 :certainty +16 :temporal-blur +0)) (:debrief (:terseness -8 :certainty +32)) (:cart-swap-lull (:temporal-blur +16)))Black Ledger’s voice is more certain than most carts. The ledger is either balanced or it isn’t.
Structurally Important Moments Preserved on CIPHER-LINE
Section titled “Structurally Important Moments Preserved on CIPHER-LINE”| Beat | Intent | CIPHER-LINE fragment(s) |
|---|---|---|
| Anomaly detected | ”Transaction pattern deviates from peers.” | anomaly. paper-thin. (annotate, anomalous) |
| Round-trip found | ”Money moved out and came back, net zero.” | round-trip. (one fragment; enough) |
| Evidence chain complete | ”Chain closes. Beneficiary identified.” | chain closes. then one name. (significant) |
| Verdict correct | ”Conspiracy exposed. Payout transferred.” | called it. then paid. (debrief) |
| Verdict incorrect | ”Theory rejected. Partial payout.” | missed something. (annotate, tense) |
| Hot-swap invitation (to ICE Breaker) | “Encrypted records require intrusion.” | ledger's encrypted. then need the other cart. |
nEmacs Contributions
Section titled “nEmacs Contributions”Per ADR-0016 (nEmacs + REPL + Input Model), each cart declares what its scripted-mission surface looks like — grammar fragments contributed to the predictive palette, domain vocabulary that earns the +5 ranking boost (ADR-0016 §7), whether it uses prompt-text for raw text entry (§8), and whether any of its keys bind :double-tap or :long-press events (§9). Black Ledger’s forensic-deduction character translates directly into nEmacs: the operator can author predicate-shaped queries that walk the ledger and flag suspicious transactions programmatically — a move-efficient alternative to pointing and clicking through every account.
Scripted Missions?
Section titled “Scripted Missions?”Yes — audit-logic scripting. Rep-10+ operators unlock the Audit Logic bounty chain, which expressly rewards authoring Lisp predicates that match the case’s fraud pattern. A well-crafted (shell-account?) predicate costs fewer moves than manual investigation because a single EVAL sweeps the ledger and returns suspicious rows. Scripted missions remain optional on the critical path (ADR-0002) — a low-rep operator solves every case by manual drilldown. The high-rep operator writes a one-liner and saves thirty moves.
Typical scripted-mission shapes:
(shell-account? acct)— predicate that matches common shell-corp signatures.(round-trip? tx-set)— detects money that left and returned net-zero within a window.(filter-by (predicate) ledger)— general query over the current case.(trace-beneficiary acct :depth 5)— walks the account graph looking for a terminal destination.
Cart Grammar Fragments
Section titled “Cart Grammar Fragments”Contributed via (emacs-extend-grammar ...) at cart-load:
(emacs-extend-grammar ;; Ledger primitives (acct (id)) ; returns account record (tx-list (acct)) ; transactions for account (balance (acct &optional :at date)) (counterparty (tx)) (amount (tx)) (shell-account? (acct)) ; returns boolean + evidence list (round-trip? (tx-set &key :window-days)) (trace-beneficiary (acct &key :depth)) ;; Evidence primitives (flag (tx-or-acct :reason string)) ; adds to evidence chain (link-evidence (a b :reason string)) (chain-complete?) ; verdict-ready predicate (submit-verdict (beneficiary)) ;; Query combinators (filter-by (predicate ledger)) (group-by (key ledger)) (move-cost) ; remaining move budget (case-meta)) ; current case metadataVocabulary Contribution
Section titled “Vocabulary Contribution”Via (emacs-extend-vocabulary ...). Forensic / financial domain terms:
(emacs-extend-vocabulary "account" "ledger" "transaction" "balance" "date" "amount" "counterparty" "shell" "holding" "trust" "round-trip" "wash" "layering" "structuring" "beneficiary" "nominee" "payee" "payer" "audit" "evidence" "chain" "verdict" "flag" "link" "suspicious" "clean" "paper-thin" "anomaly" "forensic" "trace" "hierarchy" "deposit" "withdrawal" "microtransaction" "rounding")prompt-text FFI Usage
Section titled “prompt-text FFI Usage”Yes — account lookup and annotation. Two call sites:
| Call site | Purpose | Typical length |
|---|---|---|
| Account lookup | Enter an account ID or holding-company name to jump the cursor | 4–20 chars |
| Evidence annotation | Attach an operator-authored note to a flagged transaction (“shell — nominee director X”) | 10–60 chars |
Account lookup is diegetic (the operator is reading real case data). Annotations are persisted into the case file and factor into verdict scoring — a case closed with notes that match the ground-truth pattern scores higher than one closed with flags alone.
Double-Tap and Long-Press Bindings
Section titled “Double-Tap and Long-Press Bindings”Black Ledger opts into ADR-0016 §9 with a move-economy lens — double-taps that would consume a move are suppressed; bindings expand what a single move sees rather than granting free actions:
| Key | :tap | :double-tap | :long-press |
|---|---|---|---|
INFO | inspect — shows metadata | inspect-full — adds counterparty chain (no move cost) | show-pattern-match — lists rules that match this tx |
CAR | drill-into | drill-deep — descend two levels (costs 1 move) | — |
QUOTE | flag-for-review | — | unflag-all-in-view — clear pending flags (no move cost) |
EQ | compare-selected | compare-three — pull in a third account | — |
Row 24 renders: INFO:INSPECT INFO²:FULL CAR:DRILL QUOTE:FLAG QUOTE…:UNFLAG EQ:COMPARE EVAL:SUBMIT.
Context-Polymorphic Key Semantics (Cart Gameplay)
Section titled “Context-Polymorphic Key Semantics (Cart Gameplay)”Black Ledger’s cart has two primary cursor contexts: ledger view (scrolling rows) and account view (drilled into a specific account’s chain):
| Key | Ledger view | Account view |
|---|---|---|
INFO | Inspect row / account | Inspect tx metadata |
CAR | Drill into selected account | Drill into linked account |
CDR | Next account / parent | Next transaction |
CONS | Add evidence link | Add tx to evidence chain |
EVAL | Run active predicate | Submit verdict (when chain-complete) |
QUOTE | Flag account | Flag transaction |
EQ | Compare two selections | Compare two tx amounts |
BACK | Return to case index | Return to ledger view |
| Numpad | Row select | Tx index select |
When the operator drops into nEmacs to compose a predicate (e.g., custom shell-account? definition), the keymap yields to :nemacs-nav scope per ADR-0016 §3 — standard editor dispatch, Row 24 flips to editor verbs.