diff --git a/planning_notes/overall_story_plan/mission_initializations/m05_insider_trading/stages/stage_1/story_arc.md b/planning_notes/overall_story_plan/mission_initializations/m05_insider_trading/stages/stage_1/story_arc.md
new file mode 100644
index 0000000..09b96d2
--- /dev/null
+++ b/planning_notes/overall_story_plan/mission_initializations/m05_insider_trading/stages/stage_1/story_arc.md
@@ -0,0 +1,1378 @@
+# Mission 5: "Insider Trading" - Stage 1: Narrative Structure
+
+**Mission ID:** m05_insider_trading
+**Stage:** 1 - Narrative Structure
+**Version:** 1.0
+**Date:** 2025-12-29
+
+---
+
+## Mission Overview
+
+**Duration:** 70-90 minutes
+**Target Tier:** 2 (Intermediate)
+**Mission Type:** Corporate Investigation (Non-Combat)
+**Tone:** Corporate thriller, moral complexity, investigative tension
+
+---
+
+## Three-Act Structure Summary
+
+### Act 1: The Corporate Infiltration (20-25 minutes)
+Player infiltrates Quantum Dynamics as security consultant, meets CSO Patricia Morgan, and begins investigation into data exfiltration.
+
+### Act 2: The Investigation (35-45 minutes)
+Player interviews employees, gathers evidence, exploits Bludit CMS, and narrows suspects to identify David Torres as the insider.
+
+### Act 3: The Confrontation & Choice (15-20 minutes)
+Player confronts Torres with evidence, learns his motivations, and makes critical choice about how to resolve the situation.
+
+---
+
+## Opening Briefing: "Operation Schrödinger"
+
+**Location:** SAFETYNET HQ (background image shown, player hasn't moved yet)
+**NPC:** Agent 0x99 (timedConversation with delay: 0)
+**Duration:** 3-5 minutes
+
+### Concrete Stakes Establishment
+
+**Agent 0x99's Briefing:**
+
+"We've got a critical situation. ENTROPY's Insider Threat Initiative has compromised Quantum Dynamics Corporation."
+
+**THE SPECIFIC THREAT:**
+
+"They're calling it Operation Schrödinger. An insider is exfiltrating 4.2 terabytes of classified quantum cryptography research—Project Heisenberg."
+
+**THE SPECIFIC DATA:**
+- Military quantum key distribution protocols (847 pages, classified)
+- 14 zero-day vulnerabilities in competitor quantum systems
+- DoD deployment database: 247 military facilities, installation schedules, network topology
+- Cryptographic key material from government testing
+
+**THE BODY COUNT IF WE FAIL:**
+
+"If this data reaches foreign governments, here's what happens:"
+
+1. **Immediate Casualties: 12-40 intelligence officers**
+   - Previously-encrypted communications can be retroactively decrypted
+   - Human intelligence sources exposed
+   - Field operatives compromised
+
+2. **Strategic Impact:**
+   - $4.2 billion DoD quantum crypto program wasted
+   - 247 military facilities vulnerable during installation windows
+   - China and Russia gain 5-year quantum supremacy advantage
+
+3. **Long-term Damage:**
+   - US quantum computing industry destroyed
+   - 450 Quantum Dynamics employees lose jobs (company bankruptcy)
+   - Global quantum cryptography adoption delayed 5-10 years
+
+**ENTROPY'S CALCULATION:**
+
+"Intelligence shows they've already exfiltrated 73% of the data. They have buyers lined up—Chinese MSS, Russian GRU, Iranian IRGC. Expected sale price: $45-70 million USD split across ENTROPY cells."
+
+**URGENCY:**
+
+"The final exfiltration is scheduled for this weekend: the DoD deployment schedules and the competitor zero-days. Those are the most dangerous pieces."
+
+"12 to 40 intelligence officers will die if those schedules reach foreign governments. ENTROPY knows this. They calculated it."
+
+**THE MISSION:**
+
+"Infiltrate Quantum Dynamics as external security consultant. Identify the insider. Stop the final exfiltration. Prevent the sale."
+
+"Quantum Dynamics' CSO suspects someone on the Project Heisenberg team, but internal investigation came up empty. The insider is sophisticated."
+
+"You'll need to interview employees, analyze evidence, and identify who's working for ENTROPY before the weekend deadline."
+
+### Opening Briefing Variables Tracked
+
+```ink
+VAR mission_briefed = false
+VAR knows_operation_schrodinger = false
+VAR knows_casualty_count = false
+VAR knows_torres_identity = false  // Will be set during investigation
+```
+
+**No vague "approach" choices** - player actions during mission will determine debrief content.
+
+---
+
+## Act 1: The Corporate Infiltration (20-25 minutes)
+
+**Goal:** Establish the investigation, meet key NPCs, gain initial access to evidence systems
+
+### Beat 1.1: Arrival at Quantum Dynamics (2 minutes)
+
+**Location:** Corporate Lobby (starting room)
+
+**Player Actions:**
+- Arrives as "external security consultant" (cover identity)
+- Meets receptionist (brief NPC interaction)
+- Directed to CSO's office
+
+**Atmosphere:** Sleek corporate tech company, nervous employees, heightened security
+
+**Variables Set:**
+```ink
+VAR arrived_at_quantum_dynamics = true
+VAR cover_identity_established = true
+```
+
+### Beat 1.2: Meeting Patricia Morgan (CSO) (5-8 minutes)
+
+**Location:** Executive Wing - CSO Office
+
+**Key Dialogue Points:**
+
+**Patricia Morgan introduces the problem:**
+- "Three weeks ago, we detected anomalous network traffic"
+- "Someone is uploading encrypted data to external servers"
+- "Our internal investigation found nothing—whoever it is, they're good"
+- Shows player: network logs, access records, encrypted upload patterns
+
+**Patricia's Concerns:**
+- CEO wants this resolved quietly ("no press, no prosecution if avoidable")
+- Suspects someone on Project Heisenberg team (8 engineers)
+- Worried about DoD contract consequences
+- Frustrated by inadequate security budget
+
+**Player Receives:**
+- Temporary security badge (access to most areas)
+- Network access credentials
+- Employee roster for Project Heisenberg team
+- Security logs from past 3 weeks
+
+**Patricia's Warning:**
+"The insider doesn't know we're onto them. Don't alert them. We need to catch them red-handed with enough evidence for prosecution—or at least termination."
+
+**Variables Set:**
+```ink
+VAR met_patricia_morgan = true
+VAR has_security_badge = true
+VAR has_network_access = true
+VAR has_employee_roster = true
+VAR suspects_count = 8  // Will narrow down during investigation
+```
+
+### Beat 1.3: Initial Investigation Setup (3-5 minutes)
+
+**Location:** Security Operations Center
+
+**Player Actions:**
+- Reviews security logs at SOC terminal
+- Identifies 3 engineers with suspicious after-hours access:
+  1. David Torres (frequent server room visits, weekend uploads)
+  2. Michael Park (secretive, working late)
+  3. Dr. Amara Johnson (accessed files outside her specialty)
+
+**First Evidence Discovery:**
+- Network logs show encrypted uploads every Friday night
+- Uploads coincide with one engineer's badge access pattern
+- Data volume: 50-100 GB per week for past 8 months
+
+**Tutorial Moment:**
+Game teaches evidence correlation:
+- Compare badge access logs with network traffic timestamps
+- Cross-reference with employee work schedules
+- Identify patterns and anomalies
+
+**Variables Set:**
+```ink
+VAR reviewed_security_logs = true
+VAR suspects_narrowed = true  // From 8 to 3
+VAR identified_upload_pattern = true
+```
+
+### Beat 1.4: Employee Roster Analysis (5 minutes)
+
+**Location:** Conference Room (player's temporary workspace)
+
+**Player Reviews Employee Files:**
+
+Each file contains:
+- Name, role, tenure, access level
+- Recent performance reviews
+- Project assignments
+- Personal notes (family status, financial situation, behavioral notes)
+
+**Key Discoveries:**
+
+**David Torres:**
+- Senior Cryptography Engineer, 5 years tenure
+- Excellent performance reviews
+- NOTE: "Seemed stressed last 6 months, Dr. Chen (supervisor) concerned"
+- Personal: Wife Elena has medical issues (insurance claims on file)
+
+**Michael Park:**
+- Quantum Hardware Engineer, 3 years tenure
+- Good performance, occasional tardiness
+- NOTE: "Working late frequently, avoiding team lunches"
+- Personal: Divorced, lives alone
+
+**Dr. Amara Johnson:**
+- Quantum Algorithm Researcher, 2 years tenure
+- Brilliant, fast-track promotion candidate
+- NOTE: "Accessed Chen-Li Protocol files outside research area"
+- Personal: No red flags
+
+**Investigation Decision Point:**
+Player can choose investigation order:
+- Interview employees first (social engineering approach)
+- Investigate digital evidence first (technical approach)
+- Combine both (thorough approach)
+
+**Choice doesn't affect outcome, only pacing—game supports player agency**
+
+**Variables Set:**
+```ink
+VAR reviewed_employee_files = true
+VAR knows_torres_stress = false  // Will learn details during interview
+VAR knows_park_behavior = false
+VAR knows_johnson_access = false
+```
+
+### Beat 1.5: First NPC Interaction Choice (5 minutes)
+
+**Location:** Engineering Wing
+
+**Player encounters Lisa Rodriguez (Software Engineer, friend of Torres):**
+
+**Casual Conversation Options:**
+- Ask about team morale
+- Ask about Project Heisenberg
+- Ask about specific engineers (Torres, Park, Johnson)
+
+**Lisa's Insights (if player builds rapport):**
+- "David's been really stressed lately. His wife Elena is sick—cancer, I think."
+- "He's always been dedicated, but lately he's obsessed. Working crazy hours."
+- "Mike Park? He's been weird too, but that's personal stuff. Definitely not work-related."
+- "Amara's great. Brilliant researcher. No way she's involved in anything shady."
+
+**Red Herring Development:**
+Lisa inadvertently makes player suspect Park more (affair with HR manager, explains secretive behavior)
+
+**First Moral Complexity Seed:**
+Player learns Torres has sympathetic motive (medical bills), complicating future confrontation
+
+**Variables Set:**
+```ink
+VAR talked_to_lisa = true
+VAR knows_elena_illness = false  // Will confirm later
+VAR knows_torres_financial_stress = false  // Hints only
+VAR park_red_herring_active = true  // Will be resolved in Act 2
+```
+
+### Act 1 Climax: Discovery of the Bludit Server (3 minutes)
+
+**Location:** IT Department (Server Room access required)
+
+**Player Progress:**
+- Uses RFID cloner on IT Manager Marcus Webb to access server room
+- Scans internal network from server room terminal
+- Discovers hidden web service: `bluditblog.tech` (personal blog domain)
+
+**Network Scan Results:**
+```
+Scanning Quantum Dynamics internal network...
+Found: 247 active hosts
+
+Interesting services detected:
+- 192.168.10.45: HTTP/443 (bluditblog.tech) [SUSPICIOUS]
+- Content Management System: Bludit v3.9.2
+- Owner: D. Torres (employee badge 4472)
+- Last access: 2 hours ago
+```
+
+**Player Realization:**
+Torres runs a personal blog server on company network (security violation but common). Could be communication channel with ENTROPY.
+
+**Investigation Path Opens:**
+Act 2 will involve exploiting this Bludit server to extract evidence
+
+**Variables Set:**
+```ink
+VAR discovered_bludit_server = true
+VAR knows_torres_owns_blog = true
+VAR can_access_vm_challenge = true  // Unlocks SecGen scenario
+```
+
+### Act 1 Summary: Investigation Foundations Laid
+
+**Player Has:**
+- Access to Quantum Dynamics (badge, network credentials)
+- Narrowed suspects from 8 to 3 (Torres, Park, Johnson)
+- Discovered upload pattern (Friday nights, encrypted data)
+- Found potential evidence source (Torres' Bludit server)
+- Learned sympathetic motive (Elena's illness)
+
+**Next Steps for Act 2:**
+- Exploit Bludit CMS vulnerability to access Torres' communications
+- Interview remaining employees to gather behavioral evidence
+- Correlate digital evidence with physical evidence
+- Confirm Torres as the insider
+
+---
+
+## Act 2: The Investigation (35-45 minutes)
+
+**Goal:** Gather definitive evidence, exploit Bludit CMS, eliminate red herrings, confirm Torres as insider
+
+### Beat 2.1: VM Challenge - Bludit Exploitation (15-20 minutes)
+
+**Location:** Server Room or Conference Room (VM terminal access)
+
+**SecGen Scenario: "Feeling Blu" (Bludit CMS Exploitation)**
+
+**Player Objectives:**
+1. Access Torres' personal Bludit blog server
+2. Exploit CVE-2019-16113 (directory traversal)
+3. Upload web shell and gain server access
+4. Escalate privileges via sudo misconfiguration
+5. Extract evidence from database and encrypted files
+
+**Flag Progression:**
+
+**Flag 1: "Recruitment Timeline" (FTP/Initial Access)**
+- Recovered from Bludit database
+- Shows Torres' recruitment by "The Recruiter" 8 months ago
+- Payment records: $45,000 received so far, $200,000 promised total
+- Evidence Torres believed he was helping "investigative journalists"
+
+**Flag 2: "Digital Vanguard Servers" (Service Enumeration)**
+- Network communication logs
+- IP addresses of Digital Vanguard infrastructure
+- Proof Torres uploaded data to ENTROPY servers
+- Exfiltration timestamps match badge access logs
+
+**Flag 3: "Exfiltrated File Manifest" (Exploitation)**
+- Complete list of stolen files (3.1 TB of 4.2 TB)
+- Includes: QKD protocols, zero-days, partial DoD deployment database
+- Proves what Torres has already stolen
+- Remaining targets: Final DoD schedules + remaining zero-days
+
+**Flag 4: "The Architect's Approval" (Privilege Escalation)**
+- Encrypted message from "The Architect" to Digital Vanguard
+- Approves Operation Schrödinger
+- Authorizes foreign sales to Chinese MSS and Russian GRU
+- References expected revenue: $45-70 million
+
+**Game Integration:**
+Each flag submitted at drop-site terminal unlocks:
+- **Flag 1:** Access to Torres' encrypted personal files (medical bills for Elena)
+- **Flag 2:** Network topology map showing ENTROPY infrastructure
+- **Flag 3:** Confirmation of what data still needs to be secured
+- **Flag 4:** Evidence proving ENTROPY's true plan (not "journalism")
+
+**Variables Set:**
+```ink
+VAR bludit_exploited = true
+VAR flag1_submitted = false
+VAR flag2_submitted = false
+VAR flag3_submitted = false
+VAR flag4_submitted = false
+VAR evidence_level = 0  // Increments with each flag, affects confrontation options
+```
+
+### Beat 2.2: Employee Interviews (10-15 minutes)
+
+**Parallel to VM Challenge** - Player can interleave interviews with hacking
+
+**Interview 1: Dr. Sarah Chen (Torres' Supervisor)**
+
+**Location:** Engineering Wing - Chen's Office
+
+**Key Information:**
+- "David is one of my best engineers. Brilliant cryptographer."
+- "He's seemed stressed lately, but I attributed it to project deadlines."
+- "His access to Project Heisenberg is legitimate—he's lead developer on QKD protocols."
+- "Wait... he's been accessing files outside his immediate project scope. I didn't notice."
+
+**Chen's Reaction to Investigation:**
+- Defensive of her team initially
+- Realizes she missed warning signs
+- Provides technical context on what stolen data enables
+- Emotional: "If David did this, those DoD soldiers... their lives..."
+
+**Variables Set:**
+```ink
+VAR interviewed_chen = true
+VAR chen_confirms_torres_access = true
+VAR knows_human_cost = true
+```
+
+**Interview 2: Michael Park (Red Herring Resolution)**
+
+**Location:** Hardware Lab
+
+**Key Information:**
+- Nervous when questioned (red herring intensifies briefly)
+- Eventually admits: Having affair with HR manager (why he's secretive)
+- Working late to avoid going home (recent divorce)
+- Provides alibi: Was at girlfriend's house during upload times
+
+**Player learns:** Park is innocent, just dealing with personal issues
+
+**Variables Set:**
+```ink
+VAR interviewed_park = true
+VAR park_red_herring_resolved = true
+VAR suspects_count = 2  // Down to Torres and Johnson
+```
+
+**Interview 3: Dr. Amara Johnson (Second Red Herring)**
+
+**Location:** Research Lab
+
+**Key Information:**
+- Accessed Chen-Li Protocol files outside specialty because collaborating with Torres
+- Torres asked her to review cryptographic proofs (legitimate request)
+- Noticed Torres seemed distracted, made uncharacteristic mistakes recently
+- "Is David okay? He mentioned something about his wife being sick."
+
+**Player Learns:** Johnson is innocent, Torres has been sloppy due to stress
+
+**Variables Set:**
+```ink
+VAR interviewed_johnson = true
+VAR johnson_red_herring_resolved = true
+VAR suspects_count = 1  // Only Torres remains
+VAR knows_torres_mistakes = true
+```
+
+**Interview 4: Kevin Tran (Junior Engineer - Character Witness)**
+
+**Location:** Open Office Area
+
+**Key Information:**
+- Idolizes Torres as mentor
+- "David's the reason I'm in cryptography. He's patient, brilliant, kind."
+- "Something's wrong though. He used to be cheerful. Now he's just... exhausted."
+- Emotional: "Is he in trouble? Please, whatever it is, he's a good person."
+
+**Moral Weight Increases:**
+Torres is not a monster—he's a desperate man people care about
+
+**Variables Set:**
+```ink
+VAR interviewed_kevin = true
+VAR knows_torres_character = true
+VAR moral_complexity_established = true
+```
+
+### Beat 2.3: Physical Evidence Correlation (5-8 minutes)
+
+**Location:** Torres' Office (requires access after gathering digital evidence)
+
+**Player Gains Access:**
+- Office has PIN lock: 1989 (Elena's birth year, found in personal files from Bludit)
+- Or: Lockpick (medium difficulty)
+
+**Physical Evidence Found:**
+
+**1. Elena's Medical Bills (on desk)**
+- $380,000 total treatment cost
+- Insurance company denial letters
+- Experimental cancer treatment (60% survival with treatment, 15% without)
+- Children mentioned: Ages 8 and 11
+
+**Emotional Impact:** Player sees photos of Torres' family, hospital bills, desperate situation
+
+**2. Personal Journal (locked drawer - requires lockpicking)**
+
+Entries showing moral descent:
+- 8 months ago: "Met recruiter at coffee shop. Says they're investigative journalists exposing defense contractor corruption. Just background research, nothing classified."
+- 6 months ago: "They're paying me. $5K for financials. Elena's treatment costs $380K. What choice do I have?"
+- 4 months ago: "I'm in too deep. They want the QKD protocols. This is wrong. But if I stop, Elena dies."
+- 2 weeks ago: "Final upload this weekend. $200K total. Elena lives. I tell myself the journalists will use this to expose government waste. I know I'm lying to myself."
+
+**Player Realizes:** Torres knows it's wrong, did it anyway out of desperation
+
+**3. Encrypted USB Drive (locked safe)**
+
+Contains:
+- Communication logs with "The Recruiter"
+- Payment receipts ($45K received)
+- Instructions for final exfiltration (this weekend)
+- Steganography tools (for hiding data in training videos)
+
+**Definitive Proof:** Torres is the insider
+
+**Variables Set:**
+```ink
+VAR found_medical_bills = true
+VAR found_torres_journal = true
+VAR found_encrypted_usb = true
+VAR evidence_level = 4  // Maximum evidence (digital + physical)
+VAR knows_torres_guilt = true
+VAR knows_torres_regret = true
+```
+
+### Beat 2.4: The Pattern Completes (3-5 minutes)
+
+**Location:** Conference Room (player's workspace)
+
+**Evidence Correlation:**
+
+Player reviews all evidence:
+1. ✅ Network logs: Friday night uploads from Torres' workstation
+2. ✅ Badge access: Torres in server room during upload times
+3. ✅ Bludit exploitation: ENTROPY communications, payment records
+4. ✅ Physical evidence: Journal, medical bills, encrypted USB
+5. ✅ Witness testimony: Behavioral changes match timeline
+6. ✅ Financial records: Unexplained $45K deposits
+
+**Conclusion: David Torres is the insider. Evidence is overwhelming.**
+
+**Remaining Questions:**
+- How to confront him?
+- Can he be turned?
+- What about Elena and the children?
+- Final exfiltration is this weekend—how to prevent it?
+
+**Optional: CSO Patricia Morgan Check-In**
+
+**Phone call triggered by evidence completion:**
+
+Patricia: "What did you find?"
+
+Player can choose:
+- Share all evidence (full transparency)
+- Share only necessary details (protect Torres' dignity)
+- Delay report (want to confront Torres first)
+
+**Patricia's Response (if shared):**
+"Medical bills... God. That's how they get people. Find something they're desperate for, exploit it."
+
+"The CEO will want prosecution. Quantum Dynamics needs to send a message."
+
+"But... 12-40 intelligence officers. That's what matters. Can you stop the final upload?"
+
+**Variables Set:**
+```ink
+VAR evidence_correlated = true
+VAR pattern_confirmed = true
+VAR ready_for_confrontation = true
+VAR patricia_informed = false  // Player choice
+```
+
+### Act 2 Climax: Setting the Trap (2-3 minutes)
+
+**Location:** Security Operations Center
+
+**Player and Patricia (if working together) plan:**
+
+**Option A: Confront Torres Immediately**
+- Arrest risk: Torres might flee or destroy evidence
+- Benefit: Prevent this weekend's upload immediately
+
+**Option B: Wait for Final Exfiltration Attempt**
+- Catch Torres red-handed (stronger legal case)
+- Risk: Upload might succeed if timing is wrong
+- Benefit: Capture exfiltration method, trace to ENTROPY handlers
+
+**Option C: Turn Torres First**
+- Confront with evidence, offer deal before final upload
+- Benefit: Torres provides intelligence, helps prevent upload
+- Risk: Torres might not cooperate, could alert ENTROPY
+
+**Player Decides:** When and how to confront Torres
+
+**Game Design:** All paths lead to Act 3 confrontation, but player approach affects available dialogue options and outcomes
+
+**Variables Set:**
+```ink
+VAR confrontation_approach = ""  // "immediate", "trap", "turn_first"
+VAR friday_night_arrived = false  // Will trigger in Act 3
+```
+
+### Act 2 Summary: Case Closed, Moral Complexity Opened
+
+**Player Has Proven:**
+- David Torres is the insider (overwhelming evidence)
+- ENTROPY's Operation Schrödinger plan (foreign sales, intelligence officer deaths)
+- Torres' motivation (Elena's cancer, $380K medical debt)
+- Timeline (final upload this weekend)
+
+**Player Understands:**
+- Torres is desperate, not evil
+- ENTROPY exploited his vulnerability
+- Torres has family (wife Elena, children ages 8 and 11)
+- Consequences are severe regardless of choice
+
+**Next Steps for Act 3:**
+- Confront Torres with evidence
+- Present ENTROPY's true plan (not "journalists")
+- Decide: Turn, Arrest, or Sympathize
+- Prevent final exfiltration
+- Resolve Elena's situation
+
+---
+
+## Act 3: The Confrontation & Choice (15-20 minutes)
+
+**Goal:** Confront Torres, reveal ENTROPY's deception, make critical choice about resolution
+
+### Beat 3.1: The Confrontation Setup (2-3 minutes)
+
+**Location:** Torres' Office or Server Room (depends on player's chosen approach)
+
+**Timing:**
+- **Immediate Confrontation:** Player finds Torres at his desk
+- **Friday Night Trap:** Player waits in server room, catches Torres uploading data
+- **Preemptive Turn:** Player arranges private meeting via email
+
+**Torres' Initial State:**
+- Exhausted, stressed, visibly unwell
+- Wedding ring (constantly adjusting - nervous tell)
+- Laptop open (if Friday night: upload in progress)
+
+**Player Approach:**
+All paths converge on confrontation, but approach affects Torres' initial response
+
+### Beat 3.2: Presenting the Evidence (5-7 minutes)
+
+**Dialogue Structure:**
+
+**Phase 1: Accusation**
+
+Player presents evidence based on what they found:
+- Network logs (if found)
+- Bludit server exploitation results (if completed VM)
+- Physical evidence from office (journal, medical bills, USB)
+- Witness testimony (employee interviews)
+
+**Torres' Initial Response (Varies by Evidence Quality):**
+
+**High Evidence (all VM flags + physical evidence):**
+- Immediate recognition he's caught
+- Shoulders slump, accepts guilt
+- "How much do you know?"
+
+**Medium Evidence (some VM flags or physical only):**
+- Attempts denial initially
+- Player presents more evidence
+- Breaks down after seeing journal quotes or medical bills
+
+**Low Evidence (rushed investigation):**
+- Defensive, demands lawyer
+- Player can still proceed but confrontation is harder
+- Less likely to cooperate
+
+**Variables Checked:**
+```ink
+{evidence_level >= 4:
+    // Full cooperation path available
+- evidence_level >= 2:
+    // Partial cooperation possible
+- else:
+    // Limited options, legal route only
+}
+```
+
+**Phase 2: The Revelation - "They Lied to You"**
+
+**Critical Moment:** Player reveals ENTROPY's true plan
+
+**Player shows Torres:**
+- "The Architect's" approval message (from Flag 4)
+- Foreign buyer list (Chinese MSS, Russian GRU, Iranian IRGC)
+- Casualty projections (12-40 intelligence officers will die)
+- Revenue expectations ($45-70 million criminal enterprise)
+
+**Torres' Reaction:**
+
+Genuine horror and disbelief:
+- "No. No, they said... investigative journalists..."
+- "Exposing government waste, military-industrial complex corruption..."
+- Reads The Architect's message, sees foreign buyers
+- Physical reaction: Hands shaking, reading glasses off, rubbing eyes
+
+**Key Dialogue:**
+Torres: "Twelve to forty people? Intelligence officers?"
+
+Torres: "I asked The Recruiter. Multiple times. 'Who gets this data?' He said journalists. Whistleblower protection..."
+
+Torres: *reading message* "Chinese MSS... Russian GRU... God. Oh God."
+
+Torres: "Elena. The kids. What did I do for them?"
+
+**Emotional Breakdown:**
+- Torres fully realizes he's been manipulated
+- Not just corporate espionage—actual treason
+- People will die because of him
+- He traded lives for Elena's treatment
+
+**Variables Set:**
+```ink
+VAR torres_knows_truth = true
+VAR torres_horrified = true
+VAR torres_breaking_point_reached = true
+```
+
+### Beat 3.3: Torres' Story (3-4 minutes)
+
+**If player shows empathy/asks about Elena:**
+
+Torres explains full timeline:
+- Elena diagnosed Stage 3 breast cancer 10 months ago
+- Insurance denied experimental treatment ($380K cost)
+- Sold car, remortgaged house, depleted retirement
+- Children (Sofia age 11, Miguel age 8) don't know how bad it is
+- Met "The Recruiter" at Café Artemis, seemed legitimate
+- Started with "background research" - company financials
+- Gradual escalation to classified data
+- Each payment brought Elena closer to treatment
+- "I knew it was wrong. But what would you do? Let her die?"
+
+**Torres shows player:**
+- Photo of Elena and children (on desk)
+- Latest medical report (treatment working, 60% survival chance)
+- Children's drawings (on his wall - "Get well soon Mommy")
+
+**Moral Weight:**
+This is not abstract—player sees the family, understands the impossible choice
+
+**Variables Set:**
+```ink
+VAR heard_torres_story = true
+VAR saw_family_photos = true
+VAR understands_motivation = true
+```
+
+### Beat 3.4: The Critical Choice (5-6 minutes)
+
+**Player Must Decide:** How to resolve this situation
+
+**Game presents 4 options based on evidence quality and player approach:**
+
+---
+
+**CHOICE A: Turn Torres into Double Agent** (Recommended for Campaign)
+
+**Requirements:**
+- Evidence level >= 3
+- Player showed empathy during confrontation
+- Torres knows truth about ENTROPY
+
+**Player Offer:**
+- SAFETYNET witness protection for entire family
+- Elena's medical treatment fully funded (government program)
+- Torres feeds false data to ENTROPY, helps track network
+- Reduced sentence (cooperation agreement, likely probation)
+- Family stays together
+
+**Torres' Response:**
+- "You'd do that? After what I did?"
+- "What do you need from me?"
+- Agrees to cooperate fully
+- Provides: TalentStack recruiting locations, handler contact methods, 22 other insider placements
+- Becomes intelligence asset for M6-M10
+
+**Immediate Actions:**
+- Torres sends false completion message to ENTROPY
+- Uploads corrupted data for final exfiltration (SAFETYNET honey pot)
+- Provides Digital Vanguard server credentials
+- Helps secure remaining unexfiltrated data
+
+**Outcomes:**
+- ✅ Operation Schrödinger stopped
+- ✅ 12-40 lives saved
+- ✅ Elena gets treatment, family safe
+- ✅ Torres provides ongoing intelligence
+- ✅ Major ENTROPY network disruption
+
+**Campaign Impact:** HIGH - Torres intelligence crucial for M6, M8
+
+**Variables Set:**
+```ink
+VAR torres_turned = true
+VAR elena_treatment_funded = true
+VAR torres_cooperation_level = "full"
+VAR final_choice = "turn_double_agent"
+```
+
+---
+
+**CHOICE B: Arrest Torres** (Standard Resolution)
+
+**Requirements:**
+- Any evidence level
+- Player prioritizes justice over pragmatism
+
+**Player Action:**
+- Read Miranda rights
+- Formal arrest for espionage, treason
+- Torres faces 15-25 years federal prison
+
+**Torres' Response:**
+- Accepts arrest quietly
+- "I knew this was coming. I deserve it."
+- Asks: "Please... tell Elena I'm sorry. Tell the kids I love them."
+- Minimal cooperation (lawyer involvement limits intelligence)
+
+**Immediate Actions:**
+- Torres' laptop seized (prevents final upload)
+- SAFETYNET secures remaining data
+- ENTROPY network goes dark (lose track of other insiders)
+
+**Outcomes:**
+- ✅ Operation Schrödinger stopped
+- ✅ 12-40 lives saved
+- ⚠️ Elena loses medical coverage (likely death)
+- ⚠️ Children lose both parents (father in prison, mother dies)
+- ❌ Limited intelligence on ENTROPY network
+
+**Campaign Impact:** MEDIUM - One cell disrupted, ongoing intelligence lost
+
+**Variables Set:**
+```ink
+VAR torres_arrested = true
+VAR elena_treatment_lost = true
+VAR torres_cooperation_level = "minimal"
+VAR final_choice = "arrest"
+```
+
+---
+
+**CHOICE C: Sympathetic Release** (Risky Moral Choice)
+
+**Requirements:**
+- Player deeply sympathizes with Torres' situation
+- Willing to let him escape with warning
+
+**Player Action:**
+- "Take your family and disappear. I never found you."
+- Give Torres 24-hour head start
+- Destroy some evidence (obstruction of justice)
+
+**Torres' Response:**
+- Shocked, grateful, guilt-ridden
+- "I don't deserve this mercy."
+- Flees with Elena and children (location unknown)
+- ENTROPY loses asset but player loses track too
+
+**Immediate Actions:**
+- Torres deletes final data from Bludit server
+- Abandons ENTROPY (no final upload)
+- Family disappears (witness protection on their own)
+
+**Outcomes:**
+- ⚠️ Operation Schrödinger partially stopped (remaining 27% data not secured)
+- ⚠️ Some intelligence officers still at risk (data already exfiltrated sold)
+- ✅ Elena gets treatment (Torres uses ENTROPY payment)
+- ✅ Family stays together (fugitive status)
+- ❌ Player faces investigation for misconduct
+- ❌ ENTROPY network untraceable
+
+**Campaign Impact:** LOW - Negative consequences in M7 (partial data used in attacks)
+
+**Variables Set:**
+```ink
+VAR torres_released = true
+VAR torres_fled = true
+VAR player_misconduct = true
+VAR final_choice = "sympathetic_release"
+```
+
+---
+
+**CHOICE D: Full Public Exposure** (Whistleblower Route)
+
+**Requirements:**
+- Player has maximum evidence
+- Willing to burn operational security
+
+**Player Action:**
+- Leak everything to media
+- Expose both Torres AND Quantum Dynamics' unethical zero-day retention
+- Public learns of Operation Schrödinger, quantum crypto vulnerabilities
+
+**Outcomes:**
+- ✅ Operation Schrödinger stopped
+- ✅ 12-40 lives saved
+- ✅ Public awareness of insider threats
+- ❌ Quantum Dynamics destroyed (450 jobs lost, bankruptcy)
+- ❌ Quantum crypto market crashes (global impact)
+- ❌ ENTROPY's plan exposed but they scatter (can't track)
+- ❌ Player faces SAFETYNET disciplinary action
+
+**Campaign Impact:** MEDIUM - ENTROPY disrupted, SAFETYNET damaged
+
+**Variables Set:**
+```ink
+VAR exposed_publicly = true
+VAR quantum_dynamics_destroyed = true
+VAR market_panic = true
+VAR final_choice = "public_exposure"
+```
+
+---
+
+### Beat 3.5: Resolution of the Upload (2 minutes)
+
+**Immediate Technical Response** (varies by choice)
+
+**If Torres Turned:**
+- Torres sends false completion signal to ENTROPY
+- Uploads corrupted/honey pot data
+- SAFETYNET traces Digital Vanguard servers
+- Remaining data secured, zero-days patched
+
+**If Torres Arrested:**
+- Laptop seized mid-upload (if Friday night trap)
+- Upload incomplete, ENTROPY suspects compromise
+- Data secured but ENTROPY network goes dark
+
+**If Torres Released:**
+- Torres deletes upload, warns ENTROPY of investigation
+- ENTROPY scatters, harder to track
+- Partial data remains at risk
+
+**If Public Exposure:**
+- Media firestorm prevents upload
+- ENTROPY abandons operation
+- Collateral damage: Quantum Dynamics destroyed
+
+**Variables Set:**
+```ink
+VAR final_upload_prevented = true  // (or false if sympathetic release)
+VAR remaining_data_secured = true  // (varies by choice)
+VAR entropy_network_status = ""  // "tracked", "dark", "scattered"
+```
+
+### Beat 3.6: Securing Project Heisenberg (1-2 minutes)
+
+**Location:** Server Room
+
+**Final Actions:**
+- Secure remaining 1.1 TB of unexfiltrated data
+- Patch zero-day vulnerabilities in competitor systems
+- Update security protocols to prevent future insider threats
+- Generate incident report
+
+**Patricia Morgan's Reaction** (phone call):
+Varies by player choice:
+- Turned: "We'll take care of Elena. You did the right thing."
+- Arrested: "Justice served, but... God, those kids."
+- Released: "What the hell did you do? There's going to be an investigation."
+- Exposed: "The CEO is furious. SAFETYNET is reviewing your clearance."
+
+**Variables Set:**
+```ink
+VAR project_heisenberg_secured = true
+VAR security_protocols_updated = true
+VAR mission_complete = true  // Triggers closing debrief
+```
+
+### Act 3 Summary: Moral Complexity Resolved
+
+**Player Has:**
+- Stopped Operation Schrödinger (mostly)
+- Saved 12-40 intelligence officer lives (probably)
+- Made impossible choice with no "right" answer
+- Faced consequences of their decision
+- Set up campaign implications for M6-M10
+
+**Outcomes Vary Significantly:**
+- Family saved or destroyed
+- ENTROPY network tracked or lost
+- Intelligence gained or forfeited
+- Professional consequences for player
+
+---
+
+## Closing Debrief: Consequences and Campaign Setup
+
+**Location:** SAFETYNET HQ (background image, phone call)
+**NPC:** Agent 0x99
+**Trigger:** `mission_complete = true` via global variable event mapping
+**Duration:** 5-7 minutes
+
+### Debrief Structure: Reflecting Actual Player Actions
+
+**Following Stage 1 Guidelines:** Debrief references specific discoveries and choices, NOT vague "approach" labels
+
+### Phase 1: Mission Assessment (2 minutes)
+
+**Agent 0x99's Opening:**
+
+"Operation Schrödinger is contained. {final_upload_prevented: The final exfiltration was stopped.| Some data remains at risk, but the worst is prevented.}"
+
+"12 to 40 intelligence officers are alive because of your work. Remember that."
+
+**Specific Discoveries Acknowledged:**
+
+```ink
+{found_casualty_projections:
+    Agent 0x99: You found The Architect's approval message. First time we've seen direct authorization for an operation this large.
+}
+
+{flag4_submitted:
+    Agent 0x99: The foreign buyer list from Torres' Bludit server confirms our worst fears—ENTROPY is selling to state actors.
+}
+
+{interviewed_chen and interviewed_johnson and interviewed_kevin:
+    Agent 0x99: You conducted a thorough investigation. Multiple witness interviews, complete evidence correlation. Textbook work.
+}
+
+{found_torres_journal:
+    Agent 0x99: Torres' journal... reading that must have been difficult. Watching someone's moral descent in real-time.
+}
+```
+
+### Phase 2: Choice Consequences (varies - 2-3 minutes)
+
+**Consequence reporting based on player's critical choice:**
+
+**If Torres Turned (Double Agent):**
+
+Agent 0x99: "Torres is cooperating fully. Witness protection is processing his family now."
+
+Agent 0x99: "Elena's treatment starts next week. Federal program covers everything. The kids... they'll be okay."
+
+Agent 0x99: "Torres provided locations for 22 other ENTROPY insider placements. TalentStack Executive Recruiting had operatives in defense contractors, tech companies, government agencies."
+
+Agent 0x99: "This is huge. We're coordinating with FBI to roll up the entire network."
+
+**Campaign Setup:** "We'll be calling on Torres again. His intel on Insider Threat Initiative is invaluable. You made the right call—pragmatism over punishment."
+
+**Variables Set:**
+```ink
+VAR torres_available_for_m6 = true
+VAR insider_threat_network_exposed = true
+VAR handler_approves_choice = true
+```
+
+---
+
+**If Torres Arrested:**
+
+Agent 0x99: "Torres is in federal custody. Espionage, treason—he's looking at 15-25 years minimum."
+
+Agent 0x99: "His lawyer is limiting cooperation. We got some intel, but... we lost the insider network map."
+
+Agent 0x99: *pause* "Elena Torres' treatment was denied by her insurance. Without the federal witness program funding..."
+
+Agent 0x99: "The kids. Sofia and Miguel. They're with grandparents now. Father in prison, mother..." *trails off*
+
+**Moral Weight:** Game doesn't judge, but consequences are clear
+
+**Campaign Impact:** "We stopped this operation, but ENTROPY's insider recruitment program is still out there. We'll have to find it the hard way."
+
+**Variables Set:**
+```ink
+VAR torres_imprisoned = true
+VAR elena_dies = true  // Implied, not explicitly stated
+VAR insider_network_unknown = true
+VAR handler_acknowledges_cost = true
+```
+
+---
+
+**If Torres Released (Sympathetic):**
+
+Agent 0x99: "Where is David Torres?"
+
+Player: *explains decision*
+
+Agent 0x99: *long pause* "You let him go."
+
+Agent 0x99: "SAFETYNET Director wants a full investigation. Obstruction of justice, aiding and abetting a fugitive..."
+
+Agent 0x99: "I have to ask: Was saving one family worth losing track of ENTROPY's entire insider network?"
+
+**Player can respond:** (dialogue options available)
+- Defend choice (family vs. abstract intelligence)
+- Express regret (admits mistake)
+- Stand firm (no apologies)
+
+Agent 0x99: "The partial data Torres already exfiltrated—it's still out there. Some of those intelligence officers..."
+
+**Consequences:** Player faces investigation, possible suspension, reduced clearance for next missions
+
+**Variables Set:**
+```ink
+VAR player_under_investigation = true
+VAR handler_disappointed = true
+VAR partial_data_risk_remains = true
+```
+
+---
+
+**If Publicly Exposed:**
+
+Agent 0x99: "The media firestorm is... extensive."
+
+Agent 0x99: "Quantum Dynamics' stock crashed. CEO Jennifer Zhao resigned. 450 employees are being laid off."
+
+Agent 0x99: "The quantum cryptography market is in free fall. Investors are fleeing. China and Russia are laughing."
+
+Agent 0x99: "You exposed ENTROPY's plan—Operation Schrödinger is dead. But the collateral damage..."
+
+Agent 0x99: "Director Cross wants to see you. Burning operational security has consequences."
+
+**Moral Complexity:** Saved lives, exposed truth, but destroyed company and damaged national security posture
+
+**Variables Set:**
+```ink
+VAR player_disciplinary_action = true
+VAR quantum_dynamics_bankrupt = true
+VAR public_aware_of_entropy = true
+VAR handler_conflicted = true
+```
+
+---
+
+### Phase 3: ENTROPY Corporate Structure Revelation (2 minutes)
+
+**Key Campaign Moment:** First revelation that ENTROPY operates as criminal corporation
+
+Agent 0x99: "Torres' intelligence revealed something we suspected but couldn't prove."
+
+Agent 0x99: "ENTROPY isn't just coordinated cells—it's a criminal corporation with service level agreements."
+
+**The Business Model Explained:**
+
+"Insider Threat Initiative: Talent acquisition. They recruit vulnerable employees and place them in target companies. $15,000 per successful placement."
+
+"Digital Vanguard: Technical analysis. They provide exfiltration infrastructure and process stolen data. Subscription-based service."
+
+"Zero Day Syndicate: Sales and distribution. They weaponize intelligence and sell to highest bidders. Commission-based."
+
+"Crypto Anarchists: Financial services. They launder all payments and manage The Architect's central treasury."
+
+Agent 0x99: "This changes everything. We're not fighting ideological terrorists—we're fighting a Fortune 500 criminal enterprise."
+
+**Campaign Foreshadowing:**
+
+"We traced Torres' cryptocurrency payments. They flow through multiple wallets, but they all converge on one exchange: HashChain."
+
+"That's our next target. Follow the money, find the network."
+
+**Sets up Mission 6:** "Follow the Money" - Crypto Anarchists investigation
+
+**Variables Set:**
+```ink
+VAR knows_entropy_business_model = true
+VAR discovered_hashchain_exchange = true
+VAR mission_6_foreshadowed = true
+```
+
+### Phase 4: The Architect's Shadow (1 minute)
+
+**Growing Pattern Recognition:**
+
+Agent 0x99: "The Architect's approval message in Torres' files—fourth time we've seen that name."
+
+**Campaign Continuity Reference:**
+
+"Mission 1: Derek Lawson's casualty projections for Operation Shatter—approved by The Architect."
+
+"Mission 3: Victoria Sterling's client list referenced 'Architect's requirements.'"
+
+"Mission 4: Critical Mass coordination with Social Fabric—The Architect's infrastructure initiative."
+
+"Now this: The Architect authorizing foreign sales worth $45-70 million."
+
+Agent 0x99: "Someone is orchestrating all of this. Task Force Null is getting closer."
+
+**Variables Set:**
+```ink
+VAR architect_pattern_recognized = true
+VAR task_force_null_progress = true
+```
+
+### Phase 5: Personal Reflection (1 minute)
+
+**Agent 0x99's Final Thoughts:**
+
+Varies by choice, but always acknowledges moral complexity:
+
+"You faced an impossible situation. Man desperate to save his wife, manipulated by criminal organization, 12-40 lives at stake."
+
+{torres_turned:
+    "You found a third path. Not justice, not mercy—pragmatism. Using a broken man to break the organization that broke him."
+}
+
+{torres_arrested:
+    "Justice served. But justice has a cost. Those kids will grow up without parents."
+}
+
+{torres_released:
+    "You prioritized one family over abstract intelligence. I understand the impulse. I hope the cost doesn't haunt you."
+}
+
+{exposed_publicly:
+    "You chose truth over operational security. Transparency has value. So does discretion. You chose your principle."
+}
+
+"Insider threats are the hardest. The enemy isn't faceless—they're people we could have been, one bad break away."
+
+**Final Variable Updates:**
+
+```ink
+VAR mission_5_complete = true
+VAR debrief_completed = true
+VAR ready_for_mission_6 = true  // (or false if player suspended)
+```
+
+---
+
+## Complete Variable Tracking System
+
+### Global Variables (scenario.json.erb)
+
+```json
+{
+  "globalVariables": {
+    // Mission Progress
+    "mission_briefed": false,
+    "mission_complete": false,
+
+    // Investigation Progress
+    "arrived_at_quantum_dynamics": false,
+    "met_patricia_morgan": false,
+    "has_security_badge": false,
+    "has_network_access": false,
+    "suspects_count": 8,
+    "suspects_narrowed": false,
+    "discovered_bludit_server": false,
+    "bludit_exploited": false,
+
+    // Evidence Collection
+    "reviewed_security_logs": false,
+    "reviewed_employee_files": false,
+    "found_medical_bills": false,
+    "found_torres_journal": false,
+    "found_encrypted_usb": false,
+    "evidence_level": 0,
+
+    // NPC Interactions
+    "talked_to_lisa": false,
+    "interviewed_chen": false,
+    "interviewed_park": false,
+    "interviewed_johnson": false,
+    "interviewed_kevin": false,
+    "patricia_informed": false,
+
+    // VM Flags
+    "flag1_submitted": false,
+    "flag2_submitted": false,
+    "flag3_submitted": false,
+    "flag4_submitted": false,
+
+    // Key Discoveries
+    "knows_operation_schrodinger": false,
+    "knows_casualty_count": false,
+    "knows_elena_illness": false,
+    "knows_torres_identity": false,
+    "torres_knows_truth": false,
+
+    // Red Herrings
+    "park_red_herring_active": false,
+    "park_red_herring_resolved": false,
+    "johnson_red_herring_resolved": false,
+
+    // Confrontation
+    "ready_for_confrontation": false,
+    "confrontation_approach": "",
+    "heard_torres_story": false,
+    "saw_family_photos": false,
+
+    // Final Choice (CRITICAL)
+    "final_choice": "",  // "turn_double_agent", "arrest", "sympathetic_release", "public_exposure"
+    "torres_turned": false,
+    "torres_arrested": false,
+    "torres_released": false,
+    "torres_fled": false,
+    "exposed_publicly": false,
+
+    // Outcomes
+    "elena_treatment_funded": false,
+    "elena_treatment_lost": false,
+    "final_upload_prevented": false,
+    "project_heisenberg_secured": false,
+    "quantum_dynamics_destroyed": false,
+
+    // Campaign Impact
+    "torres_cooperation_level": "",  // "full", "minimal", "none"
+    "torres_available_for_m6": false,
+    "insider_threat_network_exposed": false,
+    "player_under_investigation": false,
+    "player_misconduct": false,
+
+    // ENTROPY Intelligence
+    "knows_entropy_business_model": false,
+    "discovered_hashchain_exchange": false,
+    "entropy_network_status": "",  // "tracked", "dark", "scattered"
+
+    // Handler Relationship
+    "handler_approves_choice": false,
+    "handler_disappointed": false,
+    "handler_conflicted": false
+  }
+}
+```
+
+---
+
+## Narrative Structure Complete: Summary
+
+### Mission Flow Achievement
+
+**Act 1 (20-25 min):** Corporate infiltration, initial investigation, suspect narrowing (8→3), Bludit discovery
+**Act 2 (35-45 min):** VM exploitation, employee interviews, evidence correlation, identify Torres
+**Act 3 (15-20 min):** Confrontation, reveal ENTROPY deception, critical choice, resolution
+**Total:** 70-90 minutes ✅
+
+### Concrete Stakes Established ✅
+
+- **Named Operation:** "Operation Schrödinger"
+- **Body Count:** 12-40 intelligence officers will die if player fails
+- **Specific Victims:** Human intelligence sources, field operatives
+- **ENTROPY's Calculation:** $45-70 million revenue, foreign state buyers approved
+- **Human Element:** Elena Torres (Stage 3 cancer), children Sofia (11) and Miguel (8)
+
+### Moral Complexity Achieved ✅
+
+- Torres is sympathetic (desperate, not evil)
+- No "right" answer in critical choice
+- All choices have severe consequences
+- Player sees family photos, children's drawings, medical bills
+- Choice reflects player values, not game judgment
+
+### Campaign Integration ✅
+
+- If Torres turned: Intelligence source for M6-M10
+- ENTROPY business model revealed (first time)
+- HashChain Exchange foreshadowed (M6 target)
+- The Architect pattern continues (4th mention)
+- Task Force Null investigation advances
+
+### Variables Track Actual Actions ✅
+
+No vague "approach" labels—tracks what player actually did:
+- Which NPCs interviewed
+- What evidence found
+- Which flags submitted
+- Specific dialogue choices made
+- Real consequences reflected in debrief
+
+---
+
+**Stage 1 Status:** ✅ COMPLETE
+
+**Next Stage:** Stage 2 - Atmosphere & Environment Design (tone, setting details, sensory descriptions)
+
+**Document Stats:**
+- **Length:** 990+ lines
+- **Acts:** 3 complete with detailed beats
+- **Choices:** 4 major branching paths with distinct outcomes
+- **Variables:** 60+ tracked for story and campaign
+- **Integration:** Complete VM/SecGen alignment, campaign continuity
+
+**Ready for:** Stage 2 development