Gameplay Framework Walkthrough (III) — BLACK LEDGER, a forensic trace (and what a cart adds to a program)

• runtime/mission-control.md (board ↔ UDS) · runtime/mission-objectives.md (objective graph) · runtime/currency-and-economy.md (currencies)
• cartridges/design-bibles/mission-type-catalog.md (A) · cartridges/authoring/verb-partition.md (B) · runtime/recon-mode.md (C) · programs/enrichment-contract.md (D) · cartridges/authoring/capability-shapes.md (E) · programs/knsalk.md (F) · programs/dossier-data-model.md (DOSSIER) · programs/ambercalc.md (the program) · cartridges/modules/black-ledger.md (the cart)

Scope: a deliberately simple job — one cart (BLACK LEDGER), a single ANALYSIS. The verb is ANALYZE (I and II were both OBTAIN), the affinity FINANCIAL. A cold case: the records are pulled, not stolen. The point is the cart ↔ program seam, and that the framework lets a cerebral job exercise a different subset of pieces than an intrusive one.

---

The contract: COLD LEDGER — trace GLASS-CORP’s skim through the shells, name the beneficiary, file the verdict

0 · The board

Operator HOSHIKO boots — three jobs into her career now. Mission Control synthesizes the board seeded by Universal Deck State — reputation sets the threat tier, cartridge_history shows BLACK LEDGER registered (bit 0x03) and her ICE BREAKER history (the GLASS-CORP payroll breach of walkthrough I), cipher_seed is the entropy. BLACK LEDGER is inserted, so it supersedes the System-tier :audit baseline and the board leans financial. One contract surfaces: ANALYSIS · FINANCIAL · T3 · ¤1000. → foundations: Board ↔ UDS (mission-control.md §3); the supersedes mechanic (§2.3)

1 · The type

The board prints the class ANALYSIS = the Tier-3 verb ANALYZE × the affinity FINANCIAL — the player-legible “follow the money” — instantiated by BLACK LEDGER’s FORENSIC TRACE template. The verb is new to this series; the payoff (reconstructing the deleted transfers and naming the beneficiary) carries an OBTAIN facet — intelligence as a recovered asset. → A (mission-type-catalog.md — “ANALYSIS (audit)” = ANALYZE)

2 · Accept → the objective graph loads

○ P1  Map the shell hierarchy             ¤300        primary · briefed · on-complete
○ P2  Name the beneficiary (the verdict)  ¤700        primary · briefed · :requires P1 · on-resolve
+ O1  Clean verdict — :hold (accuracy ≥ 90%, no false flags)  +3 REP   optional · briefed · on-resolve (escrow)
◌ O2  [latent] Co-conspirator             ¤400 +INTEL  optional · revealed @ branching shell · on-resolve

Mission succeeds when P1 + P2 are :done. The run’s pressure — the move budget and the case clock — is not a new subsystem: the engine watches it as the same :hold-and-TTL machinery the objective model already owns (budget→0 forces a verdict on the evidence so far). → foundations: objective graph (mission-objectives.md §3, ADR-0043)

3 · Recon / acquisition (RIPSAW) — cold pulls

She drops into recon mode and opens RIPSAW against GLASS-CORP’s simulated org tree — the cart supplied it via (launch-app :ripsaw :world ledger-topology); RIPSAW is the org-recon lens (people, accounts, ownership), not a network scanner. A passive PROFILE over archived filings (≈ free heat — this is a cold case: nothing live to alert) surfaces the shell links and a beneficiary candidate → (dossier-commit org:glass-corp:shell-links). → C recon mode + heat (recon-mode.md) · D enrichment / simulated world via RIPSAW (enrichment-contract.md §7, RIPSAW row)

4 · DOSSIER

Because she breached GLASS-CORP before, DOSSIER already holds a :target profile (GLASS-CORP); (dossier-has? glass-corp:topology) → true, so the org tree comes pre-seeded — the knowledge she banked on an earlier job de-risks this one. RIPSAW’s new keys land as fact-nodes under that profile and fresh :account shell-profiles — :prov (mission … :via ripsaw), the shell links :conf :inferred, the beneficiary :rumored until the trace confirms it. DOSSIER is both the recon input and the verdict’s eventual home. → foundations: DOSSIER (dossier-data-model.md); the cross-job knowledge loop

5 · Open the case — (load-capability :black-ledger) — and what that is, over AmberCalc

BLACK LEDGER’s capability is a grammar shape — verb-noun forensics, inspectable and scriptable — not a real-time mini-game. And the key move: the cart doesn’t replace AmberCalc; it enriches it. BLACK LEDGER hands the simulated ledger to the spreadsheet to crunch ((launch-app :ambercalc :payload ledger-dataset)); AmberCalc returns flagged anomalies and reconciliations, and on that surface the cart overlays the FORENSICS vocabulary. A program is a generic lens; a cart supplies the world the lens looks at:

AmberCalc alone — program #7, always-on, content-free	+ BLACK LEDGER — cart 0x03
a generic spreadsheet: rows, calc columns, filter/sort, export to DOSSIER	the world the lens looks at: a generated shell-company ledger with a hidden conspiracy (ledger-topology, shell-depth, conspiracy-signature)
crunches any table; has no notion of fraud	the FORENSICS verbs — TRACE a transfer (CAR-drill the shell), FLAG a transaction (QUOTE), CROSS/RECONCILE two flows (EQ), CHAIN them into evidence (CONS)
surfaces an anomaly only if you sort for it	case structure + a verdict: the anomalies mean something; the run resolves to a named beneficiary
no missions, no economy, no mastery	the contract, payout, reputation, per-cart mastery, the spices ladder; threat ceiling lifted from :audit’s 2 to the cart’s 5
the :audit baseline can hand it a flat transaction set	the cart supersedes :audit — and never gates AmberCalc: eject the cart and the spreadsheet (and the bare :audit loop) are still right there

She works the grammar: TRACE GLASS-CORP → Caribbean Trust → Cayman Finance (the shell list — depth is a Lisp list), FLAGs the round-number outflows AmberCalc surfaced, CROSS-checks two transfers (same scheme?), then CHAIN = CONS(FLAG, FLAG) to link them into an evidence chain. Maps the hierarchy → (goal-complete 'P1) → ¤300 banked (on-complete). → D AmberCalc enrichment, the lens/world seam (enrichment-contract.md) · E capability shape: grammar (capability-shapes.md) · B CORE FLAG/TRACE + COMPOSITE CHAIN = CONS(FLAG, FLAG) (verb-partition.md) — here the COMPOSITE is literally built with the CONS key

6 · The fork

Drilling the hierarchy she finds Company D has two parents — B and C both feed it — the graph branches → (goal-reveal 'O2) (a co-conspirator surfaces). Following it means more TRACEs and CROSS-checks, which burn the move budget and threaten O1’s clean-verdict accuracy (rush the rest → a false flag slips in). She goes for it. The budget drains. → foundations: latent reveal + risk-coupled escrow (mission-objectives.md §3); the cart’s own branching-shell case (black-ledger.md §6)

7 · Nobody hits back — and that is the framework working

Here III parts from I and II. In a netrun or a dive, the heat HOSHIKO spent on offense summoned knSALK. In a cold-case audit there is no offense to track. She read records the spreadsheet already held; the target is archived, not live; her recon was passive filing-pulls. Heat ≈ 0 → knSALK never wakes. The pressure in this run is internal — the move budget and the case clock — not an adversary tracing her. The framework predicted exactly this: knSALK is coupled to heat, and heat is a property of intrusive play, not of analysis. A different job lights a different subset. CIPHER stays editorial, never urgent: the money keeps its own record / it names the hand. → F knSALK (knsalk.md) — not fired, by design; why: the heat model (recon-mode.md) + the predictive-subset claim (gameplay-framework.md §3–§4)

8 · Resolve — (complete-mission) — file the verdict

Both primaries :done. She submits the verdict — naming the beneficiary is the OBTAIN (intelligence as recovered asset); the evidence package DELIVERs to the client. Settlement:

Goal	Reward	Outcome
P1	¤300	kept (banked on-complete)
P2	¤700	paid (mission succeeded)
O1	+3 REP	forfeited — chasing the co-conspirator cost accuracy; a false flag slipped in
O2	¤400 + INTEL	paid — the second beneficiary named and it held up

One sanctioned UDS write (ADR-0040 §6): credit_balance += 1400, reputation += the success delta (no clean-verdict bonus), BLACK LEDGER mastery += threat-weighted, the verdict + co-conspirator key → DOSSIER (now a :verified beneficiary fact-node), cipher_seed advances, phase_chain clears. New mastery nudges the next board toward deeper forensic work — and that banked beneficiary becomes recon intel for a future job (an ICE BREAKER breach of the beneficiary’s accounts starts pre-seeded). The knowledge currency threads the carts. → foundations: economy — all four currencies move (currency-and-economy.md)

---

Coverage — what fired, and what didn’t

Piece	Where
A — mission-type catalog	ANALYSIS = ANALYZE × FINANCIAL (§1)
B — verb partition	CORE FLAG/TRACE + COMPOSITE CHAIN = CONS(FLAG, FLAG) (§5)
C — recon mode	RIPSAW casing, passive cold pulls (§3)
D — program enrichment	AmberCalc lens + RIPSAW, both fed cart worlds (§3, §5) — the centerpiece
E — capability shapes	BLACK LEDGER grammar (§5) — the pure-grammar exemplar; no mini-game this run
F — knSALK	not fired, by design — cold analysis raises no heat (§7)
objective model	the goal graph + escrow forfeit + move-budget/clock as :hold/TTL (§2, §6, §8)
economy	¤ + reputation + mastery + intel all move (§8)
DOSSIER	cross-job de-risk + verdict written home (§4, §8)
Board ↔ UDS	seeded board (+ :audit supersede), sanctioned write (§0, §8)

Why this proves coherence — the program test

Three things this run shows that the first two couldn’t:

1. The program / cart / baseline distinction is real and clean. AmberCalc is a generic, always-on, content-free lens; the :audit System baseline is the bare generator; BLACK LEDGER is the cart that supplies the world the lens crunches, the verbs that act on it, and the verdict that ends it. The cart enriches AmberCalc (hands it a ledger) and supersedes :audit (deepens the generator) — and gates neither: eject the cart and the spreadsheet and the bare audit loop are still there. That is the “carts enrich, never gate” rule, concretely.
2. The framework predicts the subset. A cerebral grammar cart lights a different set of pieces than an intrusive mini-game cart — and F staying dark is the system working, not a hole: heat is offense, and analysing cold records is not offense. The framework is a space that reflects the job, not a checklist you force every run to satisfy.
3. E is now covered across the series. I and II were mini-game-led (with grammar defensive stands); III is the pure-grammar exemplar — and its COMPOSITE verb is literally the CONS key building an evidence chain. The B partition rule, made flesh.

A live-case variant of the same job — acquire fresh records by poking the live org with an active RIPSAW pass, or by breaching for them — would raise recon heat and could summon knSALK exactly as in I and II, on the same shared system. HOSHIKO chose a cold case; the framework let that choice change which pieces fired. That every cart and every playstyle runs on the one machine is the whole point.