There are two attackers on this page and everything depends on keeping them apart. A is the one you hired: it breaks the t-message game, and you never see inside it. A′ is the one you build: it plays the ordinary one-message CPA game, and it runs A once inside itself as a subroutine. The trouble is that A′'s challenger deals it exactly one ciphertext while A demands t — so whatever A′ builds, its two worlds differ in a single slot, and A's vectors differ in all of them. The ladder is the only thing that spans that gap, and it charges a toll of t for the crossing.
A black box under contract. You never read its code, never rewind it, and run it exactly once. It will not tell you which slot it is reading.
Contains A. Its whole job is to dress one ciphertext up as a vector of t, hand that to A, and report A's verdict as its own.
Start at the top: look at what A actually submitted. Then assemble A′ in the right-hand column, walk every rung of the ladder, and deal enough trials to watch your advantage land where the algebra says it must.
Each rung is a hybrid distribution Hi — a vector A could be handed: the first i slots carry messages from M₁, the rest from M₀. H₀ is exactly what A's own challenger deals when its bit is 0; Ht is exactly what it deals when the bit is 1. Each step between two rungs swaps a single slot — which is the only shape A′ can build, since it has one challenge ciphertext to place. The step bars are the increments pi − pi−1; they sum to δ no matter how they are distributed, which is the whole content of the telescoping.
A′ has no key. It cannot produce Enc(m₁¹), …, Enc(m₁^{i−1}) or Enc(m₀^{i+1}), …, Enc(m₀ᵗ) out of thin air. Chosen-plaintext access is the only thing that lets one challenge ciphertext be dressed as a vector of t — and it is why this theorem is true for CPA and false for eavesdropping security.
Standard construction and proof: J. Katz & Y. Lindell, Introduction to Modern Cryptography, in the section on CPA-security for multiple encryptions.