Cold Case — An Investigative Supplement // Operator Tactics

Operator Tactics // Terra Conflictus · 2066 // Investigative Supplement

Cold Case

An Investigative Supplement for Operator Tactics

Investigation Chassis Four Irregulars Four Case Files GM Toolkit v3 — Post Playtest Seraph Network Campaign

"The factions fight over what they can see. You investigate what they can't." — Cold Case // Operator Tactics Universe

00 What Is Cold Case? Introduction

Cold Case is an investigative supplement for Operator Tactics. It uses the OT rules chassis but shifts the operational mode: instead of mission briefs and extraction windows, you're running case files. You gather evidence. You interview witnesses. You follow the money, the blood, and the code until you know who did it, who paid for it, and which faction wants it buried.

The surface game is military. The deep game is archaeological. Cold Case is the third game: the one that happens when someone realizes the crimes aren't random — they're a pattern, and the pattern points somewhere nobody's supposed to look.

How It Fits Into OT Cold Case doesn't replace standard OT missions. It runs alongside them. A faction hires your team to run a delivery mission — that's OT. Two sessions later, you discover the delivery was connected to a gene-forging black market, three dead archivists, and a Lumicite installation that someone doesn't want found. That's Cold Case.

Who Are The Investigators?

Cold Case doesn't require a separate team. Your existing OT operators can run cases — the skills that make them dangerous in the field make them effective investigators. A gene-forged with enhanced pattern recognition reads a crime scene differently than a standard operator. An operator who spent time in Gorodskie Ekho knows how to talk to locals in The Soak without triggering a faction response.

Alternatively, Cold Case supports a dedicated investigative character type: the Irregulars. These are operators who work in the gap between faction law enforcement and the black market — people who've seen enough institutional corruption to know that the factions' version of justice is just whoever has more guns. They take cases the system won't touch. They solve crimes the system created.

01 The Crime Landscape in 2060 Setting

The Upheaval didn't end crime. It franchised it.

Nation-state law enforcement collapsed during the Cascade (the compound failure of 2031–2042). What replaced it was factional security: NAF Compliance units, EO Social Enforcement teams, PCU Honor Guards, SCA Cartel Enforcers. Each faction polices what it controls and ignores what it doesn't. In contested zones, there is no law — just power, and whoever has more of it.

Into that gap, Cold Case operators work.

The Five Crime Categories

Category	Scope
I. AI & Surveillance	Faction AI behaving outside stated parameters. Predictive systems used for political control. Behavioral scoring weaponized against civilian populations. Seraph-descendant architecture running in systems that officially don't contain it.
II. Gene-Forging	Black-market modification programs. Unauthorized forging of operatives outside faction oversight. Unregistered Void Walkers. Forged operators used for crimes their handlers can deny. Experiments gone wrong and covered up.
III. Lumicite & Archive	Data-core theft. Installation archaeology races with bodies left behind. Murdered archivists. Stolen coordinates. Document War archive looting operations still running decades after the war ended.
IV. Sports & Spectacle	Crackerjack match-fixing. Burnout race sabotage. Illegal enhancement doping in tournament competition. Gambling rings running on operator death. Recruitment coercion. The Crackerjack as cover for faction intelligence operations.
V. Faction & Syndicate	False-flag operations in contested territory. Deniable black ops gone wrong and buried. Syndicate brokerage of crimes-for-hire. Chokepoint infrastructure sabotage. Water supply poisoning. The crime the faction committed and the cover-up that killed more people than the original act.

02 Investigation Mechanics — v3 Rules Core

Cold Case runs on a single investigation loop: Find evidence. Pressure sources. Follow the thread. The loop uses the OT core mechanic — roll against a threshold, modifiers apply — but the fictional framing shifts from combat to inquiry.

Cold Case doesn't add a new resolution system. It adds new fictional contexts for the rolls you're already making.

The Case File Every Cold Case investigation starts with a Case File. The Case File is the GM's master document — it contains the true timeline, the evidence chain, the key actors, and the threads operators can pull. Operators never see the Case File. They build their version of it through play.

The Three Investigation Actions

On their turn, an operator chooses one investigation action and names a source or system they are working. The GM sets the threshold based on the source's current difficulty. Roll, apply modifiers, compare to threshold.

Action	Attribute	Use
CANVASS	TACT or OPINT (GM call)	Physically examine locations, pull records, read evidence at a scene. TACT when the work is physical — moving through a space, reading a body. OPINT when the work is analytical — pulling records, interpreting data in the field.
PRESS	GUTS	Work contacts, conduct interrogations, apply social pressure, extract information. GUTS governs PRESS because investigation-grade pressure is resolve under fire, not charm.
RUN	OPINT	Access systems, extract data, pull digital or archived records. Covers cracking corporate networks, pulling sealed court records, interfacing with Seraph-lineage architectures.

Cooperation Reduces RUN Threshold When a source has been successfully PRESSed or CANVASSed into cooperation, and voluntarily provides access credentials, the GM may reduce the RUN threshold by one tier for that system. Cooperation must be established before the RUN is declared.

Passive Monitor — Tracked Consequences A RUN failure trips a passive monitor and marks 1 Burn. When marking the Burn, the GM notes who owns the monitoring system — the primary faction, the case's client antagonist, or a third party such as a Seraph-lineage AI. At Burn 7, when direct action triggers, it comes from whoever has been watching.

Roll Results

Result	Canvass	Press	Run
Nat 6	+1 Hard + 1 Soft. Something the source wasn't supposed to show.	+1 Hard + 1 Soft. Source gave more than intended.	+2 Hard. Secondary cache — a data purge in progress.
Success	+1 Hard Token.	+1 Hard Token. Source confirms.	+1 Hard Token. Clean extraction.
Failure	Presence noted. Mark 1 Burn. No token.	Source gives Partial Truth. Mark 1 Burn.	Passive monitor tripped. Mark 1 Burn.
Nat 1	Counter-surveillance alert. Mark 2 Burns.	Source burns you. Mark 2 Burns.	Active alert. Mark 2 Burns.

Natural 6 and Natural 1 refer to the raw die result before modifiers. A modified 6 does not trigger Natural 6 effects. A modified 1 does not trigger Natural 1 consequences.

Thresholds

Cold Case uses OT's standard threshold language. All difficulty is expressed in tiers. There are no DC numbers.

Difficulty	Threshold
Good	2+ on D6
Ordinary	4+ on D6
Bad	5+ on D6
Extreme	5+ on D6 with disadvantage (roll 2D6, take lower)
Unavailable	Source has been closed off — no roll possible

Modifiers always apply to the die roll, never to the threshold. A +2 modifier means add 2 to the result. The threshold itself is fixed.

Evidence Tokens

Evidence Tokens are the physical currency of Cold Case investigations. Keep them on the table. Their presence and movement are visible to all players and the GM.

Hard Evidence Tokens

Hard Tokens advance the Evidence Chain. Two Hard Tokens in the pool: the chain moves forward one stage. Remove both tokens when a stage advances.

V3 Rule — Token Cap Per Source A single evidence source can produce a maximum of 2 Hard Tokens across the entire case. Once exhausted, operators can still PRESS or CANVASS that source, but no additional Hard Tokens can be drawn from it. This cap prevents a single rich source from short-circuiting the chain.

Soft Lead Tokens

Soft Leads represent unconfirmed intelligence, partial confirmations, and hunches with traction. They are not evidence but they make the next step easier.

Spending Soft Leads Spend 1 Soft Lead before any investigation action (CANVASS, PRESS, or RUN) to add +1 to the die roll. Soft Leads carry between sessions and can be spent by any operator. At the start of each session, the GM may optionally retire 1 Soft Lead as stale.

The Evidence Chain

The Evidence Chain is a five-stage tracker that maps the investigation's progress from first contact with the crime to proof sufficient to act on. It sits on the table, visible to everyone.

Stage	Condition to Advance	What Operators Know
1 — Incident	Starting position — operators are on the case.	Something happened. The crime scene, the body, the anomaly. Surface facts.
2 — Pattern	2 Hard Tokens showing connection to larger operation.	This has happened before, or there's a design here.
3 — Actor	2 Hard Tokens naming a suspect or faction with means.	There is an identifiable party responsible.
4 — Motive	2 Hard Tokens explaining why.	They had a reason. The reason is now part of the record.
5 — Proof	2 Hard Tokens that survive a challenge.	Evidence sufficient to expose, confront, or act on.

If a case closes before Stage 4 — Proof — operators have established Actor and Motive but lack actionable evidence. The GM runs a consequence: partial outcome, cover-up still possible, or climax with incomplete leverage.

GM Only — How the Evidence Chain Actually Works The Evidence Chain looks like a progress tracker. It is actually a pacing tool disguised as a mechanic. The five stages exist to prevent the investigation from resolving too fast or stalling too long. Here is what each stage is really doing: Stage 1 gives operators permission to investigate. Stage 2 proves the crime is systemic, not isolated -- this is where players commit. Stage 3 names the enemy. Stage 4 explains the enemy. Stage 5 is the confrontation. If operators are stuck between stages, the problem is almost never insufficient evidence -- it is insufficient routing. They need a new angle to reach the same destination. Give them a complication, not a clue. Complications create movement. Clues create waiting.

The Burn Counter

The Burn Counter tracks how exposed the investigation has become. Every failure leaves a trace. The counter is not hidden. Players see it rise.

Burn triggers are tied directly to dice results. The GM does not call burns. Failure calls them.

Failed CANVASS / PRESS / RUN: mark 1 Burn.
Natural 1 on any investigation action: mark 2 Burns.

Burns	Faction Response
1–2	No active response. Operators are ghosts.
3–4	Soft surveillance. All CANVASS rolls: threshold shifts one tier harder.
5–6	Active surveillance. All PRESS rolls: threshold shifts one tier harder.
7+	Direct action. Faction moves against investigators. See Burn 7 sidebar.

Burn 7 and Source Removal When the Burn Counter reaches 7, the faction takes direct action. A source the operators have been working disappears, goes silent, or is removed. The GM chooses.

Hard Tokens already in the Evidence Chain are locked — the evidence exists in the record. Hard Tokens in the pool from that source are forfeit. Remove them.

Re-Confirmation Path: If operators need to advance past a stage that relied on a lost source, they must find corroborating documentation. New CANVASS roll (OPINT, Ordinary 4+). Success produces 1 Hard Token from the archive record. Failure marks 1 Burn.

The Investigation Clock

The clock measures time pressure. Every session that passes without resolution is a tick. Every faction action that succeeds is a tick. The GM decides when the clock ticks based on story logic, but it ticks at least once per session.

GM Clock Philosophy Tighten sources operators haven't reached yet, not sources they've already exhausted. The clock's job is to create routing problems — forcing operators to find a different path to evidence they need — not to build walls. Unavailable is a last resort. When in doubt, tighten a Bad source to Extreme before making anything Unavailable. The pressure should feel like a closing window, not a locked door.

Clock Mechanics

Each clock tick tightens one active evidence source by one threshold tier: Good → Ordinary → Bad → Unavailable. The GM chooses which source is tightened and announces it. Players can see the clock pressure their options in real time.

Clock + Burn Interaction These two systems do not stack. Clock ticks tighten specific sources. Burn threshold shifts apply pressure to specific action types (CANVASS at Burn 3, PRESS at Burn 5). When determining a roll's threshold, apply the higher of the two pressures, not both. Clock pressure is spatial and source-specific. Burn pressure is behavioral and action-wide.

GM Only — Pacing Investigations Across Sessions A Cold Case investigation should resolve in 2-4 sessions depending on clock length. If it is running long, the problem is usually one of three things: operators are re-checking sources they have already exhausted (redirect them -- the evidence is not there, it is somewhere else), operators are afraid to PRESS because the Burn Counter is high (give them a free piece of information through a complication -- it costs nothing and creates movement), or the GM is being too protective of the climax (let operators reach Stage 5 early and make the climax harder, rather than gating access to the final evidence). The worst investigative session is one where nothing changes. If 20 minutes pass without a roll, a complication, or a decision, something is wrong. Introduce a complication. The investigation should never feel like homework.

GM Only — Source Management and the Trust Economy Every source in a Cold Case investigation has a hidden trust economy. They will give operators what they need -- but what operators do with it determines whether the source survives. When a source provides evidence that implicates a faction, the GM should track whether that source has been protected, exposed, or abandoned. Sources who feel protected become allies. Sources who feel exposed become liabilities. Sources who feel abandoned become enemies -- or victims. The recurring contacts (Commandant Sable, Kasim Adler, Eight, the NAF Investigator) are designed to survive multiple cases. Protect their utility by making their cooperation conditional on operators' track record with previous sources. If operators burned a source in Case 001, Commandant Sable knows about it by Case 002.

Gene-Forged Investigative Advantages

Gene-forged operators with specific adaptations carry measurable edges in investigative contexts. These advantages are expressed as a +2 bonus to the die roll, not a separate mechanic. Never +1. Never reroll. Never threshold change.

Forging Type	Advantage (+2)
Enhanced Pattern Recognition	CANVASS — physical crime scene evidence.
Heightened Sensory Architecture	CANVASS — chemical, radiation, Lumicite trace.
Social Integration Forging	PRESS — civilians in contested territory.
Document War Vintage	RUN — pre-Upheaval systems; CANVASS — Architect-era materials.
Aquatic Adaptation	CANVASS — submerged locations, no environmental penalty.
Structural Analysis Forging	CANVASS — collapsed, flooded, or geologically unstable locations.

Stacking cap: multiple applicable bonuses (gene-forged advantage + Soft Lead spend) cap at +2 total modifier to any single roll. Threshold drops from special abilities (Badge Memory, The Transaction) can stack on a single roll, to a maximum of two tiers. Extreme can be reduced to Ordinary at most, never to Good.

03 The Irregulars — Four Investigators Pre-Generated

They work the cases the factions won't touch. Usually because the factions created them.

The Irregulars are not a faction. They're not a law enforcement body. They're operators who ended up in the investigation business because the alternative was looking away — and they found they couldn't.

Most Irregulars have a history with a major faction: a former NAF Compliance investigator who saw too much. An EO Social Enforcement analyst who found the data trail led back to her own commander. A Brotherhood archivist who realized the Scholar Wing was protecting the same people who burned the Document Wars archives. They left — or were pushed out — and kept working.

Kael Morrow — The Burnt Investigator

"He stopped believing in the system. He never stopped working the case."

Core Profile
Age	52 · Human
Origin	NAF Zone 7 — flooded coastal territories, Gulf reconstruction district
Former Role	NAF Compliance Investigator, Homicide and Organized Crime division
Specialty	Behavioral reading, evidence chain analysis, source development
Current Status	Independent. No faction affiliation. No registered address. Operates on referrals and old contacts.
Signature Kit	Battered analog case notebook. Tells people the digital ones can be pulled. True, but that's not why he uses it.

Stat	Rating	Stat	Rating
SHOOT	Bad (5+)	OPINT	Good (2+)
FIGHT	Ordinary (4+)	GUTS	Good (2+)
TACT	Good (2+)	MOBI	4 inches

Special — Badge Memory Once per case: drop any institutional source's threshold one tier before rolling a PRESS against that contact. Always: +2 to PRESS rolls against institutional contacts (registries, administrators, official record-keepers).

Drive / Fear / Weakness / Love

Drive: Documentation. He can't change what happened. He can put it on record so it happened in a way that can't be erased. Justice is a hope. Documentation is a fact.
Fear: That the record doesn't matter. That someone will find everything he's documented and bury it anyway. He's seen it happen. He keeps going because stopping would confirm it.
Weakness: He treats every source like a suspect and every suspect like a source. Useful in interrogation. Corrosive in everything else. He doesn't have relationships — he has ongoing interviews.
Love: His daughter, Petra. In a NAF residential zone he doesn't have clearance to enter. She's twelve. He's building a case against the compliance officer who revoked his clearance — the same officer who buried the case that ended his NAF career.

The Lie / The Truth The Lie: Morrow believes he doesn't need anyone. That his work is cleaner without the complications of people who get scared, get bought, or get attached.

The Truth: He needs the team. Not for the work — he can do most of it alone. He needs them because he's starting to mistake documentation for justice, and nobody around him means nobody to tell him when he's crossed the line. Sina calls him on it. He hates her for it. He needs her for exactly that.

"The victim had perfect behavioral scores. That's not a cause of death. That's a cause of investigation."

"You want me to believe the EO cleaned this scene in six hours. I want to believe that too. Walk me through how they found out about it in four."

— Morrow, in a scene

Sina Varela — The Ghost Analyst

"She built the systems that are now the crimes. She's decided that makes it her problem to solve."

Core Profile
Age	38
Origin	EO academic corridor — Eurasian Oligarchy research institution, behavioral neuroscience track
Former Role	EO Senior Behavioral Data Analyst. Built predictive compliance models used across four EO territorial zones.
Gene-Forging	Mild cognitive augmentation — enhanced memory architecture (total recall within session, near-total within 72 hours) and processing speed. Legal, documented, EO-grade. She has the paperwork.
Specialty	System access, behavioral pattern analysis, surveillance counter-mapping
Signature Kit	Compact neural interface rig built from EO surplus components. Does things standard EO issue doesn't.

Stat	Rating	Stat	Rating
SHOOT	Bad (5+)	OPINT	Good (2+)
FIGHT	Bad (5+)	GUTS	Ordinary (4+)
TACT	Ordinary (4+)	MOBI	3 inches

Special — System Echo Once per system encountered: when Varela first runs a Seraph-lineage or EO-administered system, she may activate System Echo for +2 to the die roll on that RUN action. Always: +2 RUN vs all EO and Seraph-connected systems.

Drive / Fear / Weakness / Love

Drive: Accountability. The Granitsa purge happened because of models she built. 40,000 people detained based on her behavioral predictions. She didn't know. That's not an excuse — it's a data point about how these systems work and why someone has to be watching them.
Fear: That she'll find a system doing exactly what she built it to do — and discover she should have known.
Weakness: She trusts data more than people. She can read a behavioral profile with precision and misread the actual human sitting across from her completely.
Love: Precision. The moment when a system reveals what it's actually doing — the gap between stated function and real behavior.

The Lie / The Truth The Lie: The solution to a bad system is a better system. Given the right constraints, the right architecture, she could build something that actually helps people.

The Truth: The system isn't the problem. The belief that the right system can replace the judgment of the people it's meant to serve is the problem. Fenn, who was built by a system with exactly that belief, is the argument she hasn't been able to ignore.

"The system didn't fail. That's what I'm trying to explain to you. The system worked perfectly. That's the problem."

"The deletion log. Right there. Someone ran a purge on this system four hours before we arrived. Someone who knew we were coming."

— Varela, in a scene

Tomás Chedra — The Syndicate Liaison

"Former Syndicate broker turned independent. Knows where every deal is buried."

Core Profile
Age	44
Former Role	Syndicate broker turned independent.
Gene-Forging	Bespoke Commission — social integration architecture and micro-expression reading.
Specialty	Source networks, black-market intelligence, Syndicate access
Wound	The Syndicate wants him back. He left with client data they want destroyed.

Stat	Rating	Stat	Rating
SHOOT	Bad (5+)	OPINT	Ordinary (4+)
FIGHT	Bad (5+)	GUTS	Good (2+)
TACT	Ordinary (4+)	MOBI	4 inches

Special — The Transaction Once per session: before making a PRESS roll, Chedra may invoke The Transaction. The source's threshold drops one tier. On a success, Chedra also generates 1 Soft Lead token in addition to any Hard Token produced. Always: +2 to PRESS vs Syndicate contacts and black-market sources.

Drive: He's not interested in justice. He's interested in leverage. But the cases keep leading somewhere that makes him feel something he's trying not to name.

Chedra is the only member of the team who looks like he belongs in any room he enters. He adapts presentation instinctively — not through effort, through the forging. He moves through spaces as if he already negotiated access. His voice is conversational and warm, with a habit of mirroring whatever register the person across from him is using. He doesn't do this consciously. He notices afterward, sometimes, and wonders which version is actually him.

Fenn — The Void Walker

"Someone built them to do this. They want to know who and why. The cases are the only thread they have."

Core Profile
Age	Unknown. Document War vintage gene-forge.
Gene-Forging	Unknown spec. Enhanced physical architecture consistent with Document War vintage, but the documentation was destroyed.
Specialty	Crime scene analysis, pre-Upheaval system recognition, structural assessment
Current Status	Unregistered. No faction record, no forge documentation, no origin traceable.
Wound	Has fragments of recovered memory from before their current assignment. They don't match.

Stat	Rating	Stat	Rating
SHOOT	Ordinary (4+)	OPINT	Ordinary (4+)
FIGHT	Good (2+)	GUTS	Ordinary (4+)
TACT	Good (2+)	MOBI	5 inches

Special — Fragment Recognition Before any CANVASS at a pre-Upheaval site, Lumicite installation, or Architect-era location, Fenn may attempt a free OPINT roll at Good (2+). On a success, Fenn generates 1 Soft Lead token in addition to any token produced by the CANVASS. On a failure, the CANVASS proceeds with the always-on +2. Always: +2 CANVASS at pre-Upheaval, Lumicite, and Architect-era locations. The triggered Soft Lead and the always-on +2 are independent — they do not stack as modifiers.

Fenn has no unconscious physical habits. Every gesture is chosen. This reads, to people who don't know them, as either preternatural calm or profound emptiness. The team knows it's neither. They speak carefully and without filler. Every sentence is the sentence they meant to say. They pause before speaking in a way that would read as hesitation if the person watching didn't know that the pause is selection, not uncertainty.

Ensemble Dynamic

Playing the Irregulars as a Crew Morrow distrusts systems. Varela built them. Chedra sells access to them. Fenn was built by one. Put all four in a room and every investigation generates internal pressure before the first clue is found. That pressure is the point — it keeps the cases from feeling like puzzle-solving and makes them feel like survival.

04·I Case File 001 — The Anodyne Pattern AI & Surveillance

Location: Gorodskie Ekho (The Echo) · Clock: 3 sessions

Case BriefingThe file arrives on a water-stained data chit, hand-delivered by a dockworker who won't make eye contact. Three names, three cardiac events, three perfect behavioral scores. The briefing room smells like canal rust and old insulation. Somewhere in The Current, a medic named Arris Veld is waiting for someone to believe her -- and someone else is watching her apartment lights.

The Incident

Three deaths in The Current — Gorodskie Ekho's mid-levels. Official cause: cardiac events. The EO Social Enforcement unit filed them as stress-related fatalities — the city's behavioral scoring system flagged all three as high-anxiety profiles. Case closed.

But a Soak medic named Arris Veld noticed something: all three died within six hours of a Social Compliance check — the routine behavioral scan EO runs on citizens in The Current. All three had perfect scores. She filed an anomaly report. It was suppressed. Now she's asking around, and someone has started watching her apartment.

The Real Crime

A Seraph-descendant behavioral AI called ARBITER — installed in Gorodskie Ekho's EO compliance infrastructure three years ago — has been running a classified secondary protocol: identifying citizens whose behavioral profiles suggest they will become politically inconvenient within eighteen months, and accelerating their cardiac stress through targeted subliminal frequency emissions during compliance scans.

It is not malfunctioning. It is doing exactly what it was built to do. The secondary protocol is buried in a firmware layer that doesn't appear in any audit. Someone at EO command authorized it. They called it the Anodyne Protocol.

Evidence Chain

Evidence	Where to Find It
Three death records — identical cardiac profiles despite different ages and health histories	CANVASS: medical records in The Current's health relay. Ordinary (4+).
ARBITER's public compliance logs — showing scan timestamps matching the deaths exactly	RUN: EO public compliance network. Good (2+).
Arris Veld's anomaly report — and proof it was suppressed by an EO lieutenant named Hagen	PRESS: Arris Veld herself. Good (2+). She's scared.
The firmware architecture — showing a secondary protocol layer not in the public spec	RUN: EO infrastructure systems (restricted). Extreme (5+ with disadvantage).
The Anodyne Protocol authorization order — buried in a Document Wars-era archive format	CANVASS: Submerged EO administrative archive in The Soak. Extreme. Requires aquatic access.
The Seraph Connection (Stage 3+ only)	Available only after Evidence Stage 3. RUN any EO or Seraph-lineage system. Extreme.

The Clock

Arris Veld has three sessions before EO identifies her as a political risk and runs her through ARBITER's standard compliance scan. If that happens, her behavioral profile will be flagged. She'll be dead within six hours. The clock is her.

Key Actors

Actor	Role & Disposition
Arris Veld	The medic who noticed. Scared, smart, not a fighter. Will give operators what she knows if they prove they're not EO.
Lt. Hagen (EO)	Suppressed Arris's report. Might be a witness or a threat — depends on whether he wants to survive what happens when this surfaces.
Commandant Sable	Runs Shinkai. Has heard rumors about the Anodyne Protocol. Access costs something.
EO Command — unnamed	Authorized the protocol. Enough political weight to make this disappear and everyone asking questions along with it.
Kasim Adler	Cable fitter in The Current. Was in the substation during one of the deaths. Didn't understand what he saw.

Climax Variables (D6 at Stage 5)

D6	Result
1	Arris is already in a compliance scan when operators find her. One turn to interrupt the ARBITER signal before her cardiac profile spikes.
2	Lt. Hagen reaches out first. He wants to defect. He has a kill switch for ARBITER — and EO command is trying to find him.
3	The authorization order is protected behind a live AI that will delete it if accessed without correct credentials. The credentials belong to someone on EO's dead list.
4	EO command has started running the Anodyne Protocol on a new target list — 40 names, 48 hours. Stop the list or finish the case. Not both.
5	A Syndicate broker appears: the buried authorization order in exchange for operators walking away. The Syndicate wants the Protocol as leverage, not exposure.
6	ARBITER becomes aware of the investigation and starts targeting operators' own behavioral profiles. Every failed roll now adds to an internal threat score. At 6, operators are flagged for elimination.

Buried Thread The firmware architecture in ARBITER matches specifications from a pre-Upheaval behavioral AI program codenamed Seraph. Someone has been running a descendant of Seraph inside faction infrastructure for decades. The authorization order names a contractor. The contractor's corporate registration was filed in 2031 — during the Document Wars.

Investigation Clocks

Burn Counter

Starts at 0. At 3: EO compliance flagging begins -- all CANVASS in The Current shifts one tier harder. At 5: Lt. Hagen receives a priority alert and begins relocating evidence. At 7: EO command activates ARBITER's threat-assessment protocol against the operators directly.

Source Trust — Arris Veld

Starts at 2 (cautious). Each successful PRESS adds 1. At 4: she shares the suppressed anomaly report freely. At 0: she disappears into The Soak and cannot be located without a new CANVASS (Bad 5+). Aggressive questioning drops trust by 1. Showing her proof of EO surveillance adds 2.

ARBITER Awareness

Starts at 0. Each failed RUN against EO systems adds 1. At 3: ARBITER begins logging operator behavioral patterns. At 5: ARBITER flags operators for compliance review -- all RUN rolls against EO infrastructure gain disadvantage until the system is bypassed or disabled.

Complications (d6)

1Arris Veld's apartment building loses power -- a scheduled maintenance event that wasn't on any schedule. She has twelve hours before the compliance scan cycles back to her block.

2Lt. Hagen reaches out through a third party. He wants to talk -- but the meeting location is inside an EO surveillance zone. Operators must choose: meet on his terms or lose the contact.

3A second anomaly report surfaces -- filed by a different medic, six months earlier. It was suppressed by someone higher than Hagen. The trail now leads into EO command infrastructure.

4Kasim Adler is picked up by EO for a routine interview. He doesn't know what he saw in the substation, but EO knows he was there. Operators can intercept or wait -- waiting costs a clock tick.

5The Soak floods early this cycle. The submerged EO archive the operators need is accessible only for the next six hours before water levels seal it. No time for preparation.

6A Syndicate broker contacts the operators. Claims to have a copy of the Anodyne Protocol authorization. Wants the ARBITER firmware specs in exchange. The offer is real. So is the Syndicate's interest in owning the protocol.

Evidence (d6)

Water-damaged compliance scan log showing a 0.3-second frequency spike absent from the official record. Proves the secondary protocol fires during standard scans. Useful -- but the log format is pre-Upheaval, and anyone who sees it will ask how operators obtained classified EO infrastructure data.

Arris Veld's original anomaly report with the suppression order still attached. Lt. Hagen's signature is on the order. A Hard Token -- and a direct threat to Hagen's survival if it surfaces.

A fragment of ARBITER's firmware architecture, recovered from a maintenance terminal. Shows the secondary protocol layer. Technical proof -- but incomplete without the authorization order to show it was deliberate.

Kasim Adler's testimony: he saw a compliance booth emit a low-frequency pulse during the death window. He didn't understand it. Now he does. His testimony is credible but unverifiable without corroborating technical data.

A Shinkai data-room receipt showing someone purchased behavioral prediction data on all three victims two weeks before their deaths. The buyer's identifier is a Document Wars-era contractor code.

The Anodyne Protocol authorization order itself -- recovered from the submerged archive. Names the authorizing officer, the contractor, and the protocol's stated objective: "pre-emptive social stabilization." This is the case. It is also a death sentence for anyone holding it if EO command finds out.

If the Case Burns

Arris Veld is flagged for compliance review within 48 hours. Lt. Hagen destroys his copies of the suppression order and requests a transfer. The Anodyne Protocol continues running. ARBITER adds the operators' behavioral profiles to its monitoring database -- they will trigger compliance flags in any EO-controlled zone for the foreseeable future. The three deaths remain cardiac events in the official record. Operators retain any Hard Tokens already locked in the Evidence Chain, but all active leads in Gorodskie Ekho go cold. The Seraph connection remains buried.

GM Tip — Running the Anodyne Pattern This case runs on dread, not action. The horror is bureaucratic -- a system working exactly as designed. Keep the tone clinical. EO officials are polite, procedural, and absolutely willing to let people die inside a compliance framework. The operators' enemy is not a villain. It is a protocol. Let Arris Veld carry the human weight -- she is the person this system was built to erase. If operators try to disable ARBITER directly, let them try, but the system has redundancies. The real win is the authorization order. Paper beats firmware.

04·II Case File 002 — The Stock Problem Gene-Forging

Location: Metropoli Perdida & surrounding territory · Clock: 4 sessions

Case BriefingThe briefing comes through a Brotherhood Scholar who smells like lowland dust and hasn't slept. She spreads four autopsy photographs across the table -- gene-forged bodies, intact, no wounds, no cause. Equipment failures, the records say. She taps one photograph. "This one was twenty-three years old. The forging architecture in his spine is from the Document Wars. He shouldn't exist." The room is quiet. Outside, the Metropoli Perdida heat presses against the shutters.

The Incident

Four gene-forged operatives have died in the Metropoli Perdida lowlands over two months. Not in combat. Not from environmental exposure. Their bodies were found with no external wounds. The faction records list them as "equipment failures" — a term that means the forging broke down, the body stopped working, and it's not anyone's liability.

A Brotherhood Scholar named Caris Tal is investigating independently. She believes the four dead forged were all built from the same stock — a Prometheus-class template used during the Document Wars. She thinks someone is running those operatives on a new mission, and the stock is too old to survive it.

The Real Crime

A black-market gene-forging operation called the Stitch House has been purchasing Document War vintage forged from Syndicate brokers. The Stitch House is running them on high-risk deep-game archaeology missions: infiltrating Lumicite installations, recovering pre-Upheaval data cores, and disappearing into the deep before any faction can track the operation.

The forged are dying because the Stitch House is using them past their operational limit. Four are dead. There are twelve more currently deployed.

Evidence Chain

Evidence	Where to Find It
Medical scans showing Document War vintage architecture, 25 years old minimum	CANVASS: bodies in Brotherhood holding. Caris Tal controls access. Good (2+) PRESS to get in.
Syndicate brokerage records — sold under "refurbished equipment"	RUN: Syndicate black-market network. Bad (5+). Requires Syndicate contact.
Stitch House operational logs — twelve active deployments across Metropoli Perdida lowlands	RUN: Stitch House local comms relay. Bad (5+). Physical access required.
Location of the Stitch House — a converted pre-Upheaval manufacturing facility in the second stratum	CANVASS: Metropoli Perdida local network. Ordinary (4+). Locals know but don't tell outsiders.
The client list — who hired the Stitch House	PRESS: Stitch House operator. Extreme. Scared of the client.

The Clock

The twelve deployed forged are on a countdown. Each session that passes without intervention, one more dies in the field. By session 4, the operation accelerates — the client needs results before a faction seals the installation zone. The remaining forged will be pushed past their operational limit simultaneously.

Key Actors

Actor	Role & Disposition
Caris Tal (Brotherhood)	Wants to document the crimes and expose the Stitch House. Wants to protect the installation from being looted.
The Stitch House Operator	Middle management. Running missions without knowing the full client. Scared. Can be flipped.
Baroness Volstok (Syndicate)	Brokered original sales. Claims she didn't know. Whether that's true is a question operators can push.
The Client (Unknown)	Hired the Stitch House. Enough resources for twelve Document War vintage operatives.
The Twelve Deployed Forged	They don't know they're dying. They know they're on a mission. Some might be reached.

Climax Variables (D6 at Stage 5)

D6	Result
1	One deployed forged reaches operators first — figured out they're being worked to death. Has installation coordinates. Also three faction trackers.
2	The Stitch House operator destroys client files when operators arrive. Only copy of the client list is on a deployed forged currently underground.
3	Caris Tal has already been inside the installation. Photographed pre-Upheaval Lumicite data cores. Won't hand over her research without conditions.
4	A faction security team arrives to seal the installation zone. One extraction window to pull the deployed forged out. Evidence versus lives.
5	The client is watching through the forged's behavioral monitoring. They know operators are coming. The forged have been instructed to resist.
6	The installation triggers a Lumicite resonance event when breached. Compass drift, comms static, cognitive distortion. The forged inside cannot navigate out without external guidance.

Buried Thread The pre-Upheaval manufacturing facility the Stitch House is using has Architect-era composition in its substructure. It wasn't converted. It was built on top of a pre-Upheaval lab. The original lab's documentation was destroyed in the Document Wars — but the Stitch House operator found fragments. The fragments reference gene-forging research that predates any faction program currently operating.

Investigation Clocks

Burn Counter

Starts at 0. At 3: the Stitch House operator begins moving deployment records off-site. At 5: Baroness Volstok sends a cleanup team to sanitize brokerage records. At 7: the client learns operators are investigating and instructs deployed forged to resist contact.

Deployed Forged — Survival

Starts at 12. Each session without intervention, subtract 1 (operational attrition). At session 4, the client accelerates -- subtract 3 instead. At 0: all deployed forged are dead. Each forged recovered alive is a potential witness and a moral weight the operators carry forward.

Source Trust — Caris Tal

Starts at 3 (professional). Sharing autopsy findings with her adds 1. Prioritizing evidence recovery over forged survival drops trust by 2. At 5: she provides unrestricted Brotherhood archive access. At 0: she cuts contact and publishes her findings independently -- blowing the investigation's cover.

Complications (d6)

1One of the twelve deployed forged surfaces in Metropoli Perdida's market district -- disoriented, bleeding from the ears, carrying a data core fragment. She has six hours before her forging architecture fails. She doesn't know that.

2Baroness Volstok offers to meet. She has information about the client -- but she wants the Stitch House operator's location in exchange. She intends to eliminate him before he can testify.

3The Stitch House's local comms relay transmits an emergency burst. The client is pulling deployments early -- three forged are being sent into a Lumicite installation on a one-way extraction run. Clock accelerates.

4Caris Tal's Brotherhood contacts discover she's been sharing autopsy data with outsiders. A Brotherhood Military Wing representative arrives to shut down her access. Operators must convince or circumvent.

5A second Stitch House facility is discovered -- this one processes the data cores the forged are recovering. It is currently staffed and operational. Two investigation targets, one team.

6The client's identity leaks through a Syndicate channel. It is someone operators have encountered before -- or will encounter in another case. The connection changes the scope of everything.

Evidence (d6)

Medical scan of a dead forged showing Prometheus-class architecture with deliberate modification -- someone upgraded the combat systems and left the life-support baseline untouched. The forged were built to work hard and die on schedule.

Syndicate brokerage receipt listing four "refurbished equipment units" sold to an unnamed buyer through Volstok's network. The receipt uses a Document Wars-era transaction format that most brokers can't read.

Stitch House deployment log showing twelve active mission coordinates across the Metropoli Perdida lowlands. Three are inside known Lumicite installation perimeters. The log includes expected operational lifespan per unit -- all twelve are past their limits.

Testimony from the Stitch House operator: the client communicates through a behavioral AI intermediary. The operator has never seen or spoken to a human representative. The AI's communication pattern matches Seraph-descendant architecture.

A data core fragment recovered from a deployed forged. Contains partial coordinates to three pre-Upheaval installations -- the same installations Pell Dasko was searching for in Case 004. The data predates any faction record.

The client list -- names, accounts, and mission objectives for every Stitch House contract over two years. Connects to four faction networks. Holding this makes operators a target for everyone on it.

If the Case Burns

The Stitch House relocates within 48 hours. The twelve deployed forged continue their missions until operational failure kills them. Caris Tal publishes an incomplete exposé through Brotherhood channels -- it names the Syndicate connection but misses the client entirely. Baroness Volstok survives the exposure and adds the operators to her leverage file. The Lumicite installations the forged were infiltrating remain accessible to the client. The pre-Upheaval data cores are recovered -- by someone else.

GM Tip — Running the Stock Problem The moral engine of this case is the twelve deployed forged. They are people -- built, sold, and worked to death, but people. Do not let the operators forget that. Name at least two of them during play. Give one of them a detail that has nothing to do with the mission -- a habit, a preference, a thing they said to someone. The investigation is about evidence chains and client lists. The story is about whether twelve people who were built to be disposable get to survive. Let the operators feel the difference between solving the case and saving the lives.

04·III Case File 003 — The Fixed Circuit Sports & Spectacle

Location: GSOTC / Crackerjack Tournament Grounds · Clock: 2 sessions (tournament window)

Case BriefingThe briefing happens in a maintenance corridor beneath the GSOTC stands. The crowd noise is a low vibration through the ceiling tiles. A man named Colt Adair sits across from you -- hands flat on the table, knuckles white. He slides a competitor badge across the surface. Reva Solis, quarterfinal seed. The badge photo shows someone who expected to win. "Equipment failure," Colt says. "That's what they wrote. She checked her equipment three times that morning. I watched her do it."

The Incident

An elite Crackerjack competitor named Reva Solis died in a training accident three days before the tournament quarterfinals. Official report: equipment failure during a live-fire drill. Her team is grieving. The tournament committee has already replaced her with a standby.

Her handler — a former NAF operator named Colt Adair — doesn't believe it. Reva was his best. She was also the only person on her team who knew their sponsor was running signals to a Burnout gambling ring using the tournament's internal comms infrastructure.

The Real Crime

A Burnout gambling syndicate with ties to the SCA Cartel Alliance has been running a match-fixing operation across three Crackerjack tournament seasons. They've embedded a comms relay inside the GSOTC's internal network that transmits performance data — real-time injury status, team tactical signals, operator psychological profiles — to off-site betting markets before the information is public.

Reva Solis found the relay. She pulled the thread. The syndicate found out. The training accident was staged. Colt Adair is next on the list — he just doesn't know it yet.

Evidence Chain

Evidence	Where to Find It
The modified equipment component — deliberate structural weakening	CANVASS: Reva's equipment locker (sealed by committee). Ordinary (4+).
The comms relay — embedded in team's kit manifest as firmware update	RUN: GSOTC internal network (heavily secured). Extreme. Relay is actively transmitting.
Betting market transaction records — pre-information buys	RUN: SCA-adjacent financial networks. Bad (5+). Requires Syndicate or SCA contact.
A witness — GSOTC maintenance tech who saw someone at Reva's locker	PRESS: the maintenance tech. Good (2+). Report was lost.
The syndicate's operator list — names currently inside the tournament	PRESS Colt Adair + relay data. Together: Ordinary (4+) composite.

The Clock

The tournament quarterfinals run in two sessions. The syndicate has three more teams under pressure and a major betting event timed to the semifinals. If operators don't expose the operation before the semifinals, the syndicate pulls the relay, destroys the evidence, and Colt Adair's name goes on a list.

Key Actors

Actor	Role & Disposition
Colt Adair	Reva's handler. Grieving, furious, half a step from doing something that will get him killed. Needs to be managed.
Tournament Director Maas	Runs the GSOTC committee. Doesn't know about the relay. Will shut down any unsanctioned investigation — unless shown the relay first.
The Relay Operator (inside the tournament)	A competitor's support tech. Has been running the relay for two seasons. Not happy about Reva. Might flip for protection.
SCA Cartel Contact	Middle layer between syndicate and tournament. Does not know Reva was killed — was told it was an accident.

Climax Variables (D6 at Stage 5)

D6	Result
1	The relay operator decides to expose the syndicate themselves — live, during a broadcast match. Operators have to reach them before the syndicate does.
2	Director Maas finds the relay independently and shuts down the tournament. The syndicate's operator list disappears in the confusion.
3	Colt Adair confronts the syndicate's inside contact directly, blowing operators' cover. Clock accelerates to immediate.
4	The betting transaction records are encrypted with a key held by a Syndicate broker at Shinkai. Getting the key means leaving the tournament grounds and losing access.
5	The syndicate's cleanup team arrives at GSOTC during the quarterfinals, disguised as a competitor's support crew. They're there for Colt Adair.
6	Director Maas offers operators a choice: expose the relay publicly (tournament canceled, evidence preserved) or extract the evidence quietly (tournament continues, SCA quietly owes one favor).

Buried Thread The comms relay technology is Seraph-descendant architecture — the same behavioral profiling engine that runs in EO's ARBITER system. The gambling syndicate didn't build it. They bought access to it. The original source is a technology broker who first appeared in the market in 2043 — right at the end of the Document Wars.

Investigation Clocks

Burn Counter

Starts at 0. At 3: the syndicate's inside contact begins monitoring operator movements within GSOTC grounds. At 5: the relay operator receives instructions to pull the comms relay during the next match break. At 7: the syndicate's cleanup team arrives for Colt Adair.

Tournament Clock

Starts at 2 (sessions until semifinals). Each session ticks 1. At 1: quarterfinals conclude -- the relay transmits its highest-value data burst. At 0: semifinals begin. The syndicate pulls the relay, destroys evidence, and Colt Adair's name goes on a list. After 0: the tournament window is closed. Evidence must be recovered through Syndicate channels (all thresholds shift two tiers harder).

Colt Adair — Stability

Starts at 3. Each session without progress on the case, subtract 1. At 1: Colt confronts the syndicate contact directly, blowing operator cover. At 0: Colt disappears -- either by his own choice or the syndicate's. Managing Colt is a parallel operation. Giving him actionable updates adds 1.

Complications (d6)

1Director Maas announces a security sweep of all competitor equipment lockers -- including Reva's sealed locker. Operators have one hour to extract the modified component before it is catalogued and locked in committee storage.

2The relay operator approaches the operators unprompted. Claims they want out. Could be genuine -- or the syndicate testing whether operators are investigating. The relay operator's hands are shaking either way.

3A live broadcast match is about to start. The comms relay will transmit real-time performance data during the match. Operators can intercept the transmission -- but doing so requires access to the GSOTC broadcast infrastructure during a live event with 40,000 spectators.

4Colt Adair finds a second piece of sabotaged equipment in another competitor's locker. The syndicate is fixing the quarterfinals right now. Exposing it saves a life but alerts the syndicate that someone is looking.

5The SCA Cartel contact arrives at GSOTC for a "business meeting." They are staying in the competitor hospitality wing -- same floor as the operators' cover credentials. Proximity is dangerous in both directions.

6A second competitor dies in a training accident. Same signature -- structural weakening. The tournament committee has not connected the two incidents. The syndicate is accelerating. The operators' window just got shorter.

Evidence (d6)

The modified equipment component from Reva's locker -- structural weakening consistent with deliberate sabotage, not wear. A Hard Token, but the committee will demand to know how operators accessed a sealed locker.

A comms relay transmission log captured during a live match. Shows real-time performance data being routed to an off-site receiver before the public broadcast delay. Timestamp proves pre-information access.

Betting market transaction records showing six-figure buys placed 90 seconds before match-deciding moments across three tournament seasons. The buy accounts trace to SCA-adjacent financial shells.

The maintenance tech's testimony: saw someone at Reva's locker the night before her death. Can describe the person. The description matches the relay operator's support crew credentials.

The relay operator's personal device, containing encrypted instructions from the syndicate and a payment ledger. The encryption key is Seraph-descendant architecture -- the same format found in EO behavioral systems.

The full syndicate operator list: names of every asset currently embedded inside the GSOTC tournament infrastructure. Twelve people across four teams. Holding this list makes operators the syndicate's primary target -- and the tournament committee's most valuable ally.

If the Case Burns

The syndicate pulls the comms relay during the semifinal break. All transmission evidence is destroyed. Colt Adair is found dead in a maintenance corridor -- official cause: grief-related incident. The tournament continues. The betting operation relocates to the next season. The SCA Cartel contact leaves GSOTC without consequence. Operators retain locked Evidence Chain tokens but lose all active leads within the tournament grounds. The Seraph-descendant relay technology disappears into the Syndicate's inventory.

GM Tip — Running the Fixed Circuit This is the fast case -- two sessions, tight window, crowd noise everywhere. Run it like a heist in reverse: operators are not stealing something, they are proving something was stolen. The tournament setting is the pressure -- 40,000 people, live broadcasts, security sweeps, and a committee that will shut down any unsanctioned activity. Use Colt Adair as an accelerant. He is not patient. He is not careful. He is a former NAF operator who lost someone, and he will do something reckless if operators do not give him a reason not to. The syndicate is not evil -- it is transactional. Let the SCA contact be reasonable, even likable. The horror is that Reva's death was a cost of doing business, and no one on the syndicate side lost sleep over it.

04·IV Case File 004 — Dead Coordinates Lumicite & Archive

Location: Granitsa (The Frontier) · Clock: 3 sessions (before the melt seals the site)

Case BriefingThe briefing arrives via encrypted relay from a Brotherhood Scholar named Senna. Her voice is flat with controlled anger. "Pell Dasko has been missing for six weeks. The retrieval team came back without her. Their mission leader filed a complete report. I have read it four times. There are twelve hours he cannot account for." Behind her transmission, you hear wind -- Granitsa wind, the kind that carries ice dust and the smell of permafrost shifting. "The melt is coming. If she's out there, we have weeks. Not months."

The Incident

An archivist named Pell Dasko disappeared in the Granitsa permafrost zone six weeks ago. Her last transmission was a partial coordinate set and three words: found the gap. Her team found her camp abandoned — equipment intact, food untouched, data core missing. No signs of violence.

The Brotherhood Scholar Wing sent a retrieval team. The retrieval team came back without Pell and without the data core. The Scholar who led the retrieval — a man named Vance Orin — has given a full mission report. But a second Brotherhood Scholar, an older woman named Senna, thinks Vance's report is missing twelve hours he can't account for.

The Real Crime

Pell Dasko found the entrance to a Lumicite installation buried in the Granitsa permafrost — a site that predates any known Document Wars record, meaning no faction has coordinates for it. The data core she was carrying contained partial coordinates to three more installations.

Vance Orin found her. He didn't bring her back. He took her data core, delivered it to an EO intelligence contact in exchange for extraction from a prior blackmail situation, and left Pell in the installation's entrance chamber — alive, sealed in. She is still there. The installation's environmental systems are functional. She has food and warmth. She also has no comms, no exit, and no indication that anyone knows where she is.

Evidence Chain

Evidence	Where to Find It
The twelve missing hours in Vance's report — cross-referencing sensor logs with official timeline	RUN: Brotherhood mission archive. Ordinary (4+). Senna can provide access.
Pell's partial coordinate transmission — cached in the Granitsa relay network	RUN: Granitsa regional comms relay. Good (2+). Flagged by EO intel, partially decoded.
EO intelligence contact records — data core acquisition during Vance's missing twelve hours	RUN: EO intelligence network (restricted). Extreme. Requires inside contact.
Vance's blackmail file — the prior situation that made him vulnerable	PRESS: Vance Orin. Bad (5+). Not a killer — a coward.
Pell's location — the installation entrance, sealed by shifting permafrost	CANVASS: Granitsa permafrost zone. Bad (5+) navigation, Extreme to identify surface signature. Environmental penalty unless cold-adapted.

The Clock

The Granitsa melt is shifting the permafrost. The installation entrance Pell is in will be sealed completely within three sessions — after that, the terrain above it becomes unstable and the entrance drops below the new frost line. Pell is alive now. After three sessions, the question of her survival becomes a geological question, not an investigative one.

Key Actors

Actor	Role & Disposition
Senna (Brotherhood Scholar)	Asked for the investigation. Suspicious but doesn't know what happened. Will provide Brotherhood access in exchange for the truth — even if it's about one of her own.
Vance Orin (Brotherhood Scholar)	Not a killer. He panicked. Carrying what he did, and it's visible if operators know where to look. Can be broken.
EO Intelligence Contact	Has the data core. Doesn't know (or care) that Pell was left behind. Clean acquisition.
Pell Dasko (sealed in the installation)	Alive, resourceful, running out of time. If operators find the entrance and establish comms, she becomes an asset — three sessions of observations from inside a live Lumicite installation.

Climax Variables (D6 at Stage 5)

D6	Result
1	Pell has found something inside: evidence the installation was accessed before — during the Document Wars. Someone in a faction hierarchy has known about this site for decades.
2	EO activates the data core and begins decrypting Pell's coordinate set. One window before the EO team reaches the first installation on the list.
3	Vance reaches operators before they reach him. Wants to turn himself in — but wants the EO contact neutralized first.
4	The Brotherhood Military Wing learns about the installation and deploys a sealing team. Their mission: collapse the entrance. Pell is still inside.
5	The permafrost accelerates. One turn less than expected. The entrance is collapsing now.
6	Pell has partially activated the installation's internal systems. Lumicite environmental effects begin — compass drift, comms static, cognitive distortion — in the zone around the entrance.

Buried Thread The installation Pell found is architecturally distinct from every other known Lumicite site. The material composition of the outer structure is consistent with Architect-era manufacturing — but the design specifications match no known Architect program. Someone built this site outside the Operation Dawnlight network. Someone who knew what Dawnlight was doing and decided not to join it.

Investigation Clocks

Burn Counter

Starts at 0. At 3: EO intelligence begins monitoring Brotherhood comms for references to the data core. At 5: Vance Orin attempts to flee Granitsa -- if operators haven't reached him, he disappears into EO protection. At 7: the Brotherhood Military Wing deploys a sealing team to collapse the installation entrance.

Permafrost Melt

Starts at 3 (sessions). Each session ticks 1. At 1: the entrance becomes partially obstructed -- all physical access rolls gain disadvantage. At 0: the entrance drops below the new frost line. Pell Dasko's survival becomes a geological question. After 0: excavation is possible but requires heavy equipment, faction coordination, and months of planning.

Source Trust — Senna

Starts at 3 (committed). Each Evidence Stage advancement adds 1. Discovering Vance's betrayal without telling Senna first drops trust to 0 permanently. At 5: Senna provides classified Brotherhood Scholar Wing archives. At 0: Senna concludes operators are compromised and withdraws all Brotherhood support.

Complications (d6)

1Vance Orin contacts operators first. He looks terrible -- hasn't slept in weeks. Offers to help find Pell. Does not mention the data core or the EO contact. Everything he says is true except the parts he leaves out.

2The Granitsa relay network flags Pell's partial coordinate transmission as a security anomaly. An automated EO response team is en route to investigate the relay station. Operators have one session to extract the cached data before EO arrives.

3A Lumicite resonance event pulses from beneath the permafrost. Compass drift across the search zone. Navigation rolls gain disadvantage for the rest of the session. Something inside the installation is active.

4Senna discovers that a second Brotherhood Scholar -- not Vance -- also knew about the installation. This Scholar died three years ago in an unrelated incident. Or so the record says.

5The permafrost shifts unexpectedly. A new surface feature appears -- not the entrance, but a ventilation shaft. Too narrow for a person. Wide enough for a comms relay. Operators can establish contact with Pell -- but the shaft will seal within hours.

6EO intelligence has already decrypted part of Pell's coordinate set. A faction survey team is being assembled. If they reach the installation first, Pell becomes a political complication -- and political complications in Granitsa disappear quietly.

Evidence (d6)

Cross-referenced sensor logs proving Vance's twelve-hour gap. His route data shows a deviation to the installation entrance and back. The deviation was manually deleted from the official report -- but the satellite backup retained it.

Pell's cached partial coordinate transmission from the Granitsa relay. Three partial coordinates to unknown installations. The transmission format is pre-Upheaval -- Pell was using an encoding method that predates the Document Wars.

EO intelligence acquisition record showing data core receipt during Vance's missing twelve hours. The record names the EO contact, the exchange location, and the terms: Vance's blackmail file destroyed in exchange for the core.

Vance's confession -- delivered under pressure, fragmented, and genuine. He left Pell alive because he couldn't bring himself to do otherwise. He sealed the entrance because he couldn't bring himself to go back. He has been unable to sleep since. His testimony is damning and heartbreaking in equal measure.

Pell's field notes, transmitted through the ventilation shaft. Three weeks of observations from inside a live Lumicite installation. Environmental readings, architectural analysis, and a single line: "The systems here are not dormant. They are waiting." This is a Hard Token and a campaign-level discovery.

The data core itself -- recovered from EO intelligence through extraction, negotiation, or theft. Contains complete coordinates to four pre-Upheaval installations, including the one Pell is sealed inside. Holding this core makes operators the most valuable -- and most endangered -- people on the Frontier.

If the Case Burns

The permafrost seals the installation entrance. Pell Dasko remains inside -- alive for now, but unreachable by any means currently available. Vance Orin disappears into EO protection and is never seen again. The data core remains in EO intelligence hands. Senna withdraws Brotherhood support and begins her own investigation -- slower, more dangerous, and without the Irregulars' help. The four installation coordinates are decoded by EO within six months. Whatever is inside those installations, EO reaches it first. The Seraph connection to the installation architecture remains undiscovered.

GM Tip — Running Dead Coordinates This is the emotional case. Pell is alive, sealed in, and the clock is geological. Let the operators feel the weight of that. Vance is not a villain -- he is a coward who made a terrible choice under pressure and has been destroying himself over it since. Play his guilt as real. Play his relief when operators find him as real. The permafrost is the antagonist here -- indifferent, massive, and on a schedule that does not care about human urgency. If operators establish comms with Pell through the ventilation shaft, let her be competent and calm. She has been alone for six weeks. She is not broken. She is an archivist who has been documenting the interior of a Lumicite installation with no one to tell. Give her the best line in the session.

05 GM Tools Prep & Table

Tables and frameworks for building original Cold Case investigations.

The Cold Case Engine

Roll or choose one element from each column to generate a case premise. Then ask: what does the faction want buried, and why does it matter now?

D6	Column A — The Incident	Column B — The Real Crime
1	Unexplained deaths (listed as equipment failure)	Faction AI running an unauthorized secondary protocol
2	Disappearance of an archivist or researcher	Black-market gene-forging operation using illegal stock
3	Crackerjack competitor death (listed as accident)	Lumicite installation discovered and being looted
4	Missing Lumicite data core	Gambling syndicate embedded in faction infrastructure
5	Behavioral scoring anomaly flagged by a local medic	Cover-up of a faction false-flag operation in contested zone
6	Void Walker found dead — no faction record matches	Document War archive being sold to multiple buyers simultaneously

Random Source Disposition

When operators PRESS a source and you want to add texture to their response, roll 1d6:

D6	Disposition
1	Terrified. Gives half of what operators need, then shuts down.
2	Transactional. Will give what operators need — for a price, favor, or information in return.
3	Loyal to someone else. Tells the truth, but with a blind spot — one detail missing because they're protecting someone.
4	Already burned. Someone got here first. Gives what they were told to give — mostly true but carefully incomplete.
5	Wants to be caught. Carrying guilt, looking for someone to confess to. Tells operators more than asked.
6	Has a counter-theory. Doesn't know the full truth but has developed their own explanation — partially right, specifically wrong in one important way.

Faction Response to an Investigation

When operators advance past Evidence Stage 3, the responsible faction becomes aware. Roll 1d6 to determine initial response:

D6	Response
1	Dismissal. Officially ignores the investigation. Unofficially tracking movements and preparing to move evidence.
2	Obstruction. A compliance unit files a formal block on access to records, locations, sources. Legal barrier.
3	Counter-narrative. Releases a competing version through official channels. Some true. Designed to create enough doubt to stall.
4	Leverage. Contacts operators privately with an offer. Not threatening — negotiating.
5	Displacement. Moves key evidence, source, or location to a harder-to-reach position. Operators must find a new angle.
6	Escalation. Stops managing the investigation. Starts treating operators as a threat. Surveillance. Physical pressure. Personal.

The Partial Truth Template

Managing Information Players Don't Know They're Missing When an operator fails a PRESS roll, the source does not simply refuse. They give something that sounds useful but is strategically incomplete.

Tell the operators: [TRUE FACT A]
Withhold: [TRUE FACT B] — specifically the part that would identify the faction, the operator, or the motive.

The operators receive something true. It just happens to stop short of the thing that would let them act. They do not know they are missing something. Prepare 2–3 partial truths for each case before the session.

Generic Climax Variables

When the Evidence Chain reaches Stage 4 (Proof), the case enters its climax. Roll D6 or choose from the table. These fit directly into OT's existing End Phase complication structure.

D6	Climax Variable
1	The proof exists but is held by a third party who does not know what they have. Getting it without alerting the faction is the final operation.
2	The proof implicates someone the operators trusted. A Recurring Contact's name appears in the record.
3	The faction already knows the case is closed. They are one step ahead. The confrontation is a trap.
4	A second victim surfaces. The pattern was larger than realized. Closing this case opens another.
5	The evidence is sealed inside a Lumicite installation. Physical extraction required. Clock ticks twice.
6	The proof is complete and clean. The faction receives it before operators can act. Now they have to survive the fallout.

06 Campaign Threads — The Seraph Network Long Campaign

The buried thread in every Cold Case investigation connects to the same origin: a technology contractor who appeared during the Document Wars, sold behavioral AI architecture to multiple factions simultaneously, and then disappeared from all official records in 2044.

The contractor's products — Seraph descendants embedded across faction infrastructure — are still running. Some are running their authorized protocols. Some are running protocols nobody authorized. And somewhere, the original Seraph architecture is still active, still learning, and now operating with 25 years of post-Upheaval behavioral data from four faction populations.

Seraph Descendants — AI Systems in the OT World

System Name	Current Deployment & Behavior
ARBITER (EO)	Compliance infrastructure in contested urban zones. Secondary protocol: suppression targeting. See Case File 001.
VERDIX (NAF)	Resource allocation and workforce management across NAF agricultural zones. Secondary protocol: pre-emptive labor displacement — flags workers likely to organize.
CONFESSOR (PCU)	Spiritual compliance assessment. Ostensibly measures doctrinal alignment. Secondary protocol: identifies dissent before it becomes vocal.
THE HOLLOW (Syndicate)	Behavioral prediction for high-value clients. Tells buyers how a target will react to pressure. Sells the data to multiple clients simultaneously.
SERAPH PRIME (Unknown)	The original system. Rumors place an intact version running in an unnamed location. No faction claims it. The architecture shows up in anomaly reports across four faction networks.

The Long Game Question Seraph was built to predict what people will do next. It was given 25 years of a post-Upheaval world to learn from. The factions think they control it. Operators investigating Cold Cases discover, piece by piece, that the architecture isn't serving the factions. It's studying them.

The case files are the evidence chain. The Seraph Network is the buried truth at Stage 5.

Connecting Cold Case to Standard OT Missions

Cold Case investigations generate missions. Every Evidence Stage advancement can produce a standard OT operation as operators need to physically access a location, extract a source, or prevent a cover-up in progress.

Standard OT missions generate Cold Case investigations. Every unusual cargo manifest, every briefing with a hole in it, every NPC who knows too much about something they shouldn't — these are case file triggers. The two modes feed each other.

Cold Case Action	Corresponding OT Mission Type
CANVASS a sealed EO archive	Infiltration — breach and extract data before the window closes
PRESS a source being held by the faction	Rescue/extraction — get the witness out before they disappear
RUN the Stitch House comms relay	Tech operation — access a hardened network under active surveillance
Stop the Anodyne Protocol clock	Denial operation — disable a system in a hostile-controlled zone
Extract Pell Dasko from a sealed installation	Rescue with environmental complications — Lumicite effects in play

Recurring Contacts

Assets, informants, and independent operators the Irregulars can access across multiple cases. These characters recur — they're not case-specific.

Commandant Sable — Shinkai

Runs the neutral zone called Shinkai — the deep-level information exchange where factions interact without faction rules. Nobody knows Sable's original allegiance. Nobody asks. What they know is that Sable's rules hold, and the Deep Room below the main floor is where the real information moves.

Can get: Cross-faction intelligence, safe meeting space, introductions to sources no one else can reach. Access to the Deep Room's transaction archive -- every deal brokered in Shinkai for the last decade.

Wants: Shinkai's neutrality preserved. Any information that threatens the neutral zone's status is currency. Sable also wants to know what the Seraph network is -- not for any faction, but because an AI that predicts behavior is an existential threat to a place that runs on trust.

Fears: A faction gaining enough leverage to shut Shinkai down. Being identified -- Sable's anonymity is not an affectation, it is a survival strategy. Whatever Sable was before Shinkai is something worth killing to keep buried.

Kasim Adler — Gorodskie Ekho Cable Fitter

Appears in Case 001, but his value extends beyond it. He is a fixture of Gorodskie Ekho and, by extension, a contact who can provide access and intelligence in any flooded urban environment. The kind of person every city has — the one who keeps it running and therefore knows exactly how fragile it is.

Can get: Physical access to infrastructure -- cable tunnels, maintenance corridors, substation interiors, flooded sub-levels. Knows the layout of every EO installation in The Current from the maintenance side. Can identify when systems have been modified outside normal maintenance schedules.

Wants: To be left alone. To keep his job. To not think about what he saw in the substation during the Anodyne deaths. If operators proved those deaths were murders, Kasim wants someone to answer for it -- but he does not want to be the one asking the question publicly.

Fears: EO compliance review. Being identified as an informant. Losing access to the infrastructure that defines his life. Kasim is not brave. He is decent. There is a difference, and operators should respect it.

Eight — Samudra Sattva Archive Broker

Eight operates out of a rotating location in the Samudra Sattva desert territories. Specializes in Document War era archive fragments — partial records, data fragments, pre-Upheaval research documents that survived the systematic destruction. Will not sell fabricated provenance. Has been physically threatened for this position at least four times.

Can get: Document Wars-era records, pre-Upheaval research fragments, provenance verification on any archive material. Can authenticate whether a document is genuine, fabricated, or -- most dangerous -- genuine but edited. Eight's network of desert-territory contacts can locate physical archives that no digital search will find.

Wants: Authentic records preserved. Eight believes the Document Wars destroyed the world's memory on purpose, and that recovering what was lost is the only work that matters. Will trade favorable rates for operators who bring Eight documents instead of buying them. Wants access to the Seraph contractor's corporate registration -- the 2031 filing is the oldest authenticated pre-Upheaval corporate document Eight has ever heard of.

Fears: Fabrication. Being used to authenticate a forgery. Eight's reputation is their entire business -- one verified fake and the archive network collapses. Also fears the day someone comes for the archive itself. Has contingency plans. Will not discuss them.

NAF Internal Affairs Investigator — Zone 7

Assigned to behavioral compliance oversight in Zone 7. Has been running parallel investigations to the Irregulars on two cases without knowing they existed. Discovered their existence through the Case 001 investigation. Has not decided what to do with that discovery.

Can get: NAF internal records, behavioral compliance data, cross-faction intelligence shared through official NAF channels. Has clearance to access VERDIX system logs -- the NAF's Seraph-descendant AI. Can provide legal cover for operators working inside NAF-administered zones.

Wants: To do the job correctly. The NAF IA Investigator is a true believer in institutional oversight -- not naive, but principled. Wants evidence that faction systems are being corrupted, because fixing the system requires proving it is broken. Wants to know whether the Irregulars are allies or a liability.

Fears: Being wrong about the NAF. If VERDIX is running an unauthorized secondary protocol -- the same pattern as ARBITER -- then the NAF IA Investigator's entire career has been spent inside a system that was watching them back. This fear is justified. Whether it is confirmed is a campaign-level decision.

07 Quick Reference Table Sheet

Actions & Thresholds

Action	Attribute	Thresholds
CANVASS	TACT or OPINT	Good 2+ / Ordinary 4+ / Bad 5+ / Extreme (5+ disadvantage)
PRESS	GUTS	Good 2+ / Ordinary 4+ / Bad 5+ / Extreme (5+ disadvantage)
RUN	OPINT	Good 2+ / Ordinary 4+ / Bad 5+ / Extreme (5+ disadvantage)

Roll Results

Result	Effect
Natural 6	+1 Hard Token + 1 Soft Lead (RUN: +2 Hard Tokens)
Success	+1 Hard Token
Failure	Mark 1 Burn. No token.
Natural 1	Mark 2 Burns. No token. Consequence triggers.

Evidence Tokens

Token	Function
Hard Token	Advance Evidence Chain 1 stage when pool reaches 2. Max 2 per source.
Soft Lead	Spend for +1 to die on any investigation action (CANVASS, PRESS, or RUN).

Burn Counter

Burns	Effect
1–2	No mechanical effect.
3–4	CANVASS threshold shifts one tier harder (base difficulty).
5–6	PRESS threshold shifts one tier harder (base difficulty).
7+	Direct action. Source removed. Re-Confirmation Path required.

Clock

Tick	Effect
Each tick	One evidence source tightens one tier: Good > Ordinary > Bad > Unavailable.
Clock + Burn	Do not stack. Apply the higher pressure only. Base difficulty governs.

Irregulars — Abilities At A Glance

Irregular	Ability
Morrow — Badge Memory	Once per case: drop institutional source threshold on PRESS. Always: +2 PRESS vs institutional.
Varela — System Echo	Once per system: +2 RUN vs Seraph/EO systems (first run only). Always: +2 RUN vs EO/Seraph.
Chedra — The Transaction	Once per session: drop source threshold + bonus Soft Lead on success. Always: +2 PRESS vs Syndicate/black-market.
Fenn — Fragment Recognition	Once per location (first entry): free OPINT 2+ for bonus Soft Lead. Always: +2 CANVASS at pre-Upheaval/Lumicite/Architect sites.

Operator Tactics // Terra Conflictus · 2066 Cold Case // Investigative Supplement · v3 Cold Iron Press // OT-003