PHANTOM THIEVES TOOLKIT
MOCK WALKTHROUGH

The Phantom Thieves Toolkit is a live, timed, team puzzle event, produced and run in-house. It ran in December 2025: four back-to-back sessions, 119 guests in total, two rival teams per session.

A session worked like this. Guests arrived at a themed venue, registered on their own phones, and split into two crews. For two twenty-minute rounds, each crew swept one zone of the space and worked the puzzle stations built into it: printed props, mounted terminals, physical objects to handle. Then the zones swapped. Costumed actors were present the entire night and stayed in character throughout. Some carried the physical tools a puzzle required, and all of them were trained to steer a stuck team with hints delivered inside their character, so a crew got moving again without feeling like they had been told the answer. Staff broadcasts ended each round with a timed evacuation back to the hub, and the night closed with both crews in one room, phones out, playing a collective deduction finale together.

Every puzzle was written for this specific venue and setting. The app on each guest's phone tied it together: the shared timer, the live score board, answer submission with photo proof, the broadcasts, and the finale vote.

The amber bar at the bottom describes what attendees were doing at each point. Every puzzle has a reveal button. Play or skim.

THE PLAYER APP, REPLAYING A REAL ROUND

Each attendee's phone showed a countdown, their team's live board, and broadcast messages from mission control. The replay below is Session 2, Round 2, reconstructed from the event database: every solve and every broadcast fires at its recorded time, compressed to about forty seconds.

FOUR OF THE TWENTY STATIONS

Every station resolved to a single answer word. Solve them, or press REVEAL SOLUTION and move on. Nothing on this page is scored.

C // METAVERSE NAV (photographed in-room prop + actual terminal, unmodified)

ZONE 2 // CRT PROP // PHOTOGRAPHED AT THE EVENT

ZONE 2 // MOUNTED TERMINAL // FILE: a9metdec.html

FIELD NOTE This works on this page exactly the way it worked in the room. Paste a coordinate pair into Google Maps, name the landmark, type it into the terminal (letters only, no spaces), and note which letter the decryption key points at. Eight landmarks give eight letters, which spell the answer word.

REVEAL SOLUTION

The landmarks, in target order: Inokashira Park (letter 8), Shibuya Scramble (8), Tokyo National Museum (10), National Diet Building (8), Akihabara Station (5), Shinjuku Station (10), Ueno Park (2), Kanda Myojin Shrine (4). The kept letters spell ISOLATED.

THE FINALE, WITH THE REAL ROOM'S VOTES

The finale is ten multiple-choice questions that identify a mystery Palace and its ruler. Each puzzle solved during the rounds carried two intel hints, forty in total. The engine dealt them round-robin, so each attendee held a different slice on their phone. A share button posted a hint to everyone's feed.

One rule matters before you vote: any registered attendee who does not vote is counted as support for the correct answer, called Phantom Support. A locked phone never costs the room a point, and a wrong vote carries risk where abstaining does not.

Below are two of the ten questions from Session 2. Vote, then the page shows the recorded votes of the 30 attendees in that room. This room finished 10 out of 10; across the four sessions the scores were 9, 10, 10, 10.

THE BACKEND, SHOWING RECORDED EVENT DATA

Everything below is Session 2's actual database: who registered and when, every accepted solve with its claimant, the broadcast log, and the finale vote counts. Codenames were assigned from a pool, so nothing here identifies an attendee.

THE APP ITSELF, PLAYABLE

The app is the attendee's mission device. Each person opened it on their own phone and used it to register a codename, watch the shared timer, follow the live board, submit answer words with photo proof, receive staff broadcasts, and vote in the finale. Staff drove the game from a separate admin console against the same backend.

The copy below is the real Session 2 client file. One script is added to it: the PHP backend is swapped for an in-page mock seeded with the recorded event state, and the recorded room plays along as you go. Solves trickle onto the board during Round 2 and the recorded votes arrive after you open a finale question.

HOW THE MULTIPLAYER RAN LIVE

The whole system is one PHP file and one SQLite database per session, running on ordinary shared web hosting. The player app and the staff console are single HTML files. There is no framework and no build step. Deploying a session means copying a folder to the server.

Multiplayer works by polling. Every phone asks the server for the current game state every two seconds and redraws from the answer: the phase, the timer, the latest broadcasts, both teams' boards, and during the finale that player's dealt hints and vote status. Thirty phones asking every two seconds is a light load for the server. Because the phone holds nothing important, a device that sleeps, refreshes, or dies loses nothing: the codename is remembered locally, the server recognizes it on reconnect, and all progress lives in the database.

The server is the referee. It checks answers, enforces which puzzles each team may submit in the current round, rejects duplicates, and scores the finale. The phone only displays state and collects input, so nothing a player does to their own device can cheat the game. A solve submission carries the answer word plus a photo of the solved prop, taken and compressed on the phone, stored on the server, and visible to the whole room on the next poll.

The live game is a handful of values in the database: current phase, timer, finale state. The staff console edits those values through the same API behind a password. During the event, staff used it to start rounds, extend a timer, credit a solve by hand, reset a stuck team, and run the finale question by question. Timing is data rather than code, so a round could be stretched while it was running, and one was.

The finale deal is computed server-side: forty hints tied to the twenty puzzles are split evenly across each team's roster, so every phone receives its own unique share and gets the same share back after a refresh. Votes can be changed until staff locks the question. Anyone who never votes is counted toward the correct answer, and the room's most-picked choice is compared against the key.

Each of the four sessions was a separate copy of the folder with its own database, so the games ran back to back with no shared state and no cleanup between them. Two shortcuts were deliberate: polling instead of live push, because a two-second delay is invisible in a physical room, and one shared staff password, acceptable for a single night with a trusted crew. A public deployment would replace both.

UNDERNEATH THE THEME

Teams, answer keys, hint pools, finale content, and phase timing are configuration. The mechanics stay the same under any theme: timed rounds, photo-proof solves, a live board, and a hint-splitting finale.

Built and operated in-house. Ran December 2025.