Balance Mission 1 intel: Add Linux commands, improve Kevin discovery

**Technical Guidance Improvements:**
- Added basic Linux commands to Agent 0x99 help (ls, cd, cat, ls -la)
- Added sudo commands (sudo -l, sudo -u username bash)
- Players no longer expected to research basic Linux syntax
- Discovery now focuses on WHERE to apply commands, not WHAT commands exist

**Kevin Contingency Discovery (Major Change):**
- Opening briefing now hints: "Derek might have contingencies, scapegoats"
- Agent 0x99 doesn't know about Kevin frame-up beforehand
- Player discovers contingency files in Derek's computer
- New event_contingency_found: Handler reacts with shock to player's discovery
- "I suspected Derek might have failsafes, but I didn't know about this specifically"
- Handler leaves decision to player: "Kevin's fate is in your hands now"

**Design Philosophy:**
- Commands are tools (provided)
- Discovery is in application (where, when, why to use them)
- Major plot revelations belong to player (Kevin's frame-up)
- Handler has suspicions, not omniscience
- Player feels accomplished for discovering evidence

**Updated Documentation:**
- INTEL_THREADS_SUMMARY.md reflects balanced approach
- Thread #3: Linux commands provided, application discovered
- Thread #4: Sudo commands provided, execution discovered
- Thread #6: Kevin contingency now player discovery with handler reaction

This creates better gameplay: players have tools to succeed but must
discover HOW to use them and WHAT they reveal.

planning_notes/overall_story_plan/mission_initializations/m01_first_contact/07_ink_scripts/m01_opening_briefing.ink

@@ -2,17 +2,21 @@
 // Mission 1: First Contact - Opening Briefing
 // Act 1: Interactive Cutscene
 // Agent 0x99 "Haxolottle" briefs Agent 0x00
+// UPDATED: Operation Shatter - Clear evil threat
+// UPDATED: Removed vague "approach" choice - outcomes
+//          now based on actual player decisions
 // ================================================
 
-// Variables for tracking player choices
-VAR player_approach = ""          // cautious, confident, adaptable
+// Variables for tracking what player asked about (affects debrief)
 VAR asked_about_stakes = false
-VAR asked_about_entropy = false
-VAR asked_about_cover = false
+VAR asked_about_casualties = false
+VAR asked_about_architect = false
+VAR asked_about_derek = false
+VAR asked_about_maya = false
 VAR mission_accepted = false
 
 // External variables
-EXTERNAL player_name
+VAR player_name = "Agent 0x00"
 
 // ================================================
 // START: BRIEFING BEGINS
@@ -21,12 +25,11 @@ EXTERNAL player_name
 === start ===
 Agent 0x99: {player_name}, thanks for getting here on short notice.
 
-Agent 0x99: We have a situation developing at Viral Dynamics Media.
+Agent 0x99: We have a situation developing at Viral Dynamics Media. And it's worse than we initially thought.
 
 + [What's the situation?]
     -> briefing_threat
 + [I'm ready. What's the mission?]
-    ~ player_approach = "confident"
     -> briefing_threat
 + [How urgent is this?]
     ~ asked_about_stakes = true
@@ -37,29 +40,166 @@ Agent 0x99: We have a situation developing at Viral Dynamics Media.
 // ================================================
 
 === urgency_explanation ===
-Agent 0x99: ENTROPY's Social Fabric cell is operating inside Viral Dynamics right now.
+Agent 0x99: We're 72 hours from a mass casualty event.
 
-Agent 0x99: They're running disinformation campaigns targeting the upcoming election.
+Agent 0x99: ENTROPY's Social Fabric cell is operating inside Viral Dynamics. But they're not just running disinformation campaigns.
+
+Agent 0x99: They're planning something called "Operation Shatter."
 
 -> briefing_threat
 
 // ================================================
-// THREAT BRIEFING
+// THREAT BRIEFING - OPERATION SHATTER
 // ================================================
 
 === briefing_threat ===
-Agent 0x99: Social Fabric specializes in information manipulation—narrative control, social engineering at scale.
+Agent 0x99: Three weeks ago, our AI flagged something bigger than election interference.
 
-Agent 0x99: They've infiltrated Viral Dynamics as employees. We don't know how many operatives, but we've identified at least one.
+Agent 0x99: Social Fabric has spent three months collecting psychological profiles. Detailed vulnerability assessments on over two million people in the region.
 
-+ [Who's the target operative?]
++ [What kind of profiles?]
+    -> profile_details
++ [What are they planning to do with them?]
+    -> operation_shatter
++ [Two million people?]
+    -> profile_scale
+
+// ================================================
+// PROFILE DETAILS
+// ================================================
+
+=== profile_details ===
+Agent 0x99: Medical records. Prescription histories. Financial stress indicators. Documented anxiety disorders.
+
+Agent 0x99: They've identified who has insulin dependencies. Who relies on weekly dialysis. Who lives alone without family support.
+
+Agent 0x99: This isn't demographic marketing data. This is a targeting database for psychological warfare.
+
++ [What are they going to do with it?]
+    -> operation_shatter
++ [How did they get this data?]
+    -> data_source
+
+=== data_source ===
+Agent 0x99: The usual methods—breached insurance databases, compromised pharmacy systems, scraped social media.
+
+Agent 0x99: But the concerning part isn't how they got it. It's what they're planning to do with it.
+
+-> operation_shatter
+
+=== profile_scale ===
+Agent 0x99: 2.3 million profiles, to be precise. And each one includes a vulnerability score.
+
+Agent 0x99: They've categorized people by how likely they are to panic. To make dangerous decisions. To die if they receive the wrong message at the wrong time.
+
+-> operation_shatter
+
+// ================================================
+// OPERATION SHATTER - THE EVIL PLAN
+// ================================================
+
+=== operation_shatter ===
+Agent 0x99: We intercepted fragments of something called "Operation Shatter."
+
+Agent 0x99: Simultaneous fake crisis messages. Personalized. Targeted at the most vulnerable populations.
+
++ [What kind of crisis messages?]
+    -> crisis_details
++ [What's the goal?]
+    -> entropy_goal
+
+=== crisis_details ===
+Agent 0x99: Fake hospital system collapses. "Your appointment has been cancelled. All patient records corrupted."
+
+Agent 0x99: Fake bank failures. "Your funds are frozen due to suspected breach."
+
+Agent 0x99: Fake infrastructure attacks. "Water contaminated. Power grid compromised."
+
+Agent 0x99: All delivered simultaneously to people they've profiled as most likely to panic.
+
++ [That would cause mass chaos...]
+    -> casualty_projections
++ [People could die from that.]
+    ~ asked_about_casualties = true
+    -> casualty_projections
+
+=== entropy_goal ===
+Agent 0x99: Social Fabric's philosophy is "truth is obsolete, only narrative matters."
+
+Agent 0x99: But this goes beyond philosophy. They want to permanently destroy public trust in digital communications.
+
+Agent 0x99: And they're willing to kill people to make their point.
+
+-> casualty_projections
+
+// ================================================
+// CASUALTY PROJECTIONS - THE HORROR
+// ================================================
+
+=== casualty_projections ===
+Agent 0x99: {player_name}, I need you to understand what we're dealing with.
+
+Agent 0x99: We recovered fragments of their impact assessment. They've calculated projected casualties.
+
++ [How many?]
+    ~ asked_about_casualties = true
+    -> casualty_numbers
++ [They're planning to kill people?]
+    ~ asked_about_casualties = true
+    -> casualty_numbers
+
+=== casualty_numbers ===
+Agent 0x99: Their own estimates: 42 to 85 direct deaths in the first 24 hours.
+
+Agent 0x99: Diabetics who skip insulin because they believe hospitals are compromised. Elderly who have heart attacks from fake bank failure notices. Traffic fatalities from evacuation panic.
+
+Agent 0x99: And they consider these deaths... acceptable. "Educational," they call it.
+
++ [That's monstrous.]
+    -> villain_philosophy
++ [We have to stop this.]
+    -> mission_objectives
+
+=== villain_philosophy ===
+Agent 0x99: The fragment we recovered includes a note from someone called "The Architect."
+
+Agent 0x99: "These are not victims. They are examples. Their deaths will save thousands who learn the lesson: Trust nothing. Verify everything."
+
+Agent 0x99: They're true believers, {player_name}. They think murdering people is "teaching a lesson."
+
++ [Who's The Architect?]
+    ~ asked_about_architect = true
+    -> architect_mention
++ [What's my mission?]
+    -> mission_objectives
+
+=== architect_mention ===
+Agent 0x99: We don't know yet. Someone coordinating ENTROPY cells at a strategic level.
+
+Agent 0x99: But that's a problem for later. Right now, we stop Operation Shatter.
+
+-> mission_objectives
+
+// ================================================
+// MISSION OBJECTIVES
+// ================================================
+
+=== mission_objectives ===
+Agent 0x99: Your objectives:
+
+Agent 0x99: One—Find the complete Operation Shatter documentation. Target lists, message templates, deployment timeline.
+
+Agent 0x99: Two—Identify all ENTROPY operatives inside Viral Dynamics.
+
+Agent 0x99: Three—Stop the operation before Sunday. That's when they deploy.
+
++ [How do I get inside?]
+    -> cover_story
++ [Who's the primary target?]
+    ~ asked_about_derek = true
     -> operative_identity
-+ [What are they trying to accomplish?]
-    ~ asked_about_entropy = true
-    -> entropy_objectives
-+ [What's at stake if they succeed?]
-    ~ asked_about_stakes = true
-    -> stakes_explanation
++ [What resources do I have?]
+    -> resources_available
 
 // ================================================
 // OPERATIVE IDENTITY
@@ -68,87 +208,23 @@ Agent 0x99: They've infiltrated Viral Dynamics as employees. We don't know how m
 === operative_identity ===
 Agent 0x99: Derek Lawson. Senior Marketing Manager at Viral Dynamics.
 
-Agent 0x99: Perfect cover—his job is literally manipulating narratives for clients.
+Agent 0x99: Perfect cover—his job is literally manipulating narratives for clients. He's been there three months, which aligns with when the data collection started.
 
-+ [How long has he been there?]
-    -> infiltration_timeline
-+ [What's my objective?]
-    -> mission_objectives
+Agent 0x99: He's not just running operations. He authored parts of the casualty projections we intercepted.
 
-=== infiltration_timeline ===
-Agent 0x99: Three months. Long enough to install backdoors, build trust, map the organization.
-
-Agent 0x99: He's not just stealing data—he's weaponizing the company's media distribution network.
-
-+ [What's my objective?]
-    -> mission_objectives
-+ [What happens if they succeed?]
-    ~ asked_about_stakes = true
-    -> stakes_explanation
-
-// ================================================
-// ENTROPY OBJECTIVES
-// ================================================
-
-=== entropy_objectives ===
-Agent 0x99: They're collecting demographic data, testing disinformation tactics, mapping influence networks.
-
-Agent 0x99: It's all feeding into something bigger—Phase 3, though we don't know details yet.
-
-+ [What's Phase 3?]
-    -> phase_3_explanation
-+ [What's my mission?]
-    -> mission_objectives
-
-=== phase_3_explanation ===
-Agent 0x99: That's what we're trying to figure out. Multiple cells collecting different types of data.
-
-Agent 0x99: Social Fabric handles narrative manipulation. Other cells focus on infrastructure, finance, healthcare.
-
-+ [So this is part of something larger]
-    -> larger_threat
-+ [What do I need to do?]
-    -> mission_objectives
-
-=== larger_threat ===
-Agent 0x99: Exactly. But right now, we stop this cell. One operation at a time.
-
--> mission_objectives
-
-// ================================================
-// STAKES EXPLANATION
-// ================================================
-
-=== stakes_explanation ===
-Agent 0x99: If they succeed, they'll manipulate election coverage across social media and news outlets.
-
-Agent 0x99: Viral Dynamics has distribution deals with dozens of platforms. Derek controls what millions see.
-
-+ [That's... significant]
-    -> mission_objectives
-+ [We have to stop this]
-    -> mission_objectives
-
-// ================================================
-// MISSION OBJECTIVES
-// ================================================
-
-=== mission_objectives ===
-Agent 0x99: Your primary objectives:
-
-Agent 0x99: One—Identify all ENTROPY operatives inside Viral Dynamics.
-
-Agent 0x99: Two—Gather evidence of the disinformation operation.
-
-Agent 0x99: Three—Intercept their communications with other cells.
-
-+ [How do I get inside?]
-    ~ asked_about_cover = true
++ [He calculated how many people would die?]
+    -> derek_author
++ [How do I get to him?]
     -> cover_story
-+ [What resources do I have?]
-    -> resources_available
-+ [Sounds straightforward]
-    -> approach_discussion
+
+=== derek_author ===
+Agent 0x99: His signature is on the medical dependency targeting document.
+
+Agent 0x99: He personally identified which populations would be most vulnerable to fake hospital closure messages.
+
+Agent 0x99: This isn't a foot soldier following orders. He's an architect of mass casualties.
+
+-> cover_story
 
 // ================================================
 // COVER STORY
@@ -157,7 +233,7 @@ Agent 0x99: Three—Intercept their communications with other cells.
 === cover_story ===
 Agent 0x99: You're going in as an IT contractor hired to audit their network security.
 
-Agent 0x99: Completely legitimate. Viral Dynamics actually requested the audit weeks ago.
+Agent 0x99: Completely legitimate. Viral Dynamics actually requested the audit weeks ago. We just... made sure we got the contract.
 
 + [So I'll have access to technical systems]
     -> technical_access
@@ -167,16 +243,29 @@ Agent 0x99: Completely legitimate. Viral Dynamics actually requested the audit w
 === technical_access ===
 Agent 0x99: Server room, computers, network infrastructure—all fair game under your cover.
 
-Agent 0x99: Just stay professional. IT contractors ask questions; that's expected.
+Agent 0x99: That's where you'll find the Operation Shatter files. Derek keeps them encrypted, but they're there.
 
--> approach_discussion
+-> innocent_warning
 
 === employee_interaction ===
-Agent 0x99: IT contractors interact with everyone. Use it.
+Agent 0x99: Most employees at Viral Dynamics have no idea what's happening.
 
-Agent 0x99: People trust IT. They'll share passwords, complain about systems, gossip about coworkers.
+Agent 0x99: They think they work at a marketing agency. The Operation Shatter team is isolated—maybe three or four people total.
 
--> approach_discussion
+Agent 0x99: Everyone else is innocent. They'll go home to families tonight with no idea their company was planning to kill people.
+
+-> innocent_warning
+
+=== innocent_warning ===
+Agent 0x99: One more thing: there's a journalist there named Maya Chen.
+
+Agent 0x99: She contacted us anonymously. Suspected something was wrong but doesn't know the full scope. She thinks it's corporate fraud, not mass murder.
+
+Agent 0x99: Protect her identity. If Derek finds out she tipped us off, she's in danger.
+
+~ asked_about_maya = true
+
+-> resources_available
 
 // ================================================
 // RESOURCES AVAILABLE
@@ -189,55 +278,26 @@ Agent 0x99: There's a SAFETYNET drop-site terminal in their server room for subm
 
 + [What about tools?]
     -> tools_discussion
-+ [Got it. What's the approach?]
-    -> approach_discussion
++ [I'm ready to go]
+    -> final_instructions
 
 === tools_discussion ===
 Agent 0x99: Your contractor kit has lockpicks, RFID cloner, and analysis tools.
 
 Agent 0x99: Everything you need looks like standard IT equipment. Stay in character.
 
--> approach_discussion
+Agent 0x99: And {player_name}—when you find those casualty projections, photograph everything. We need complete documentation.
 
-// ================================================
-// APPROACH DISCUSSION
-// ================================================
-
-=== approach_discussion ===
-Agent 0x99: How do you want to handle this?
-
-+ [Careful and methodical—thorough investigation]
-    ~ player_approach = "cautious"
-    You: I'll take my time. Thorough beats fast.
-    Agent 0x99: Smart. Don't miss anything critical.
-    -> final_instructions
-+ [Quick and focused—complete objectives efficiently]
-    ~ player_approach = "confident"
-    You: I'll move quickly and get results.
-    Agent 0x99: Good. Just don't rush past important evidence.
-    -> final_instructions
-+ [Adaptable—read the situation as it develops]
-    ~ player_approach = "adaptable"
-    You: I'll adapt based on what I find.
-    Agent 0x99: Flexible thinking. Trust your instincts.
-    -> final_instructions
+-> final_instructions
 
 // ================================================
 // FINAL INSTRUCTIONS
 // ================================================
 
 === final_instructions ===
-Agent 0x99: Remember—Derek doesn't know we're onto him yet. Keep it that way.
+Agent 0x99: Remember—Derek doesn't know we're onto Operation Shatter. He thinks this is just an IT audit.
 
-{player_approach == "cautious":
-    Agent 0x99: Your careful approach should keep you under the radar. Document everything.
-}
-{player_approach == "confident":
-    Agent 0x99: Speed is good, but stealth is better. Stay professional.
-}
-{player_approach == "adaptable":
-    Agent 0x99: Read the room. If something feels off, trust that feeling.
-}
+Agent 0x99: Use that advantage. Gather evidence before confronting anyone.
 
 + [Any specific advice?]
     -> specific_advice
@@ -251,17 +311,29 @@ Agent 0x99: Remember—Derek doesn't know we're onto him yet. Keep it that way.
 === specific_advice ===
 Agent 0x99: The IT manager—Kevin Park—is your entry point. Build rapport with him.
 
-Agent 0x99: He's not ENTROPY, just overworked and underpaid. He'll appreciate competent help.
+Agent 0x99: He's not ENTROPY, just overworked and underpaid. He'll appreciate competent help and give you access.
 
+Agent 0x99: One thing though—Derek's meticulous. If he's planning something this big, he'll have contingencies.
+
++ [What kind of contingencies?]
+    Agent 0x99: Failsafes, scapegoats, ways to cover his tracks if things go wrong.
+    Agent 0x99: Keep your eyes open. Derek might have plans that put innocent people at risk.
+    -> deployment_choices
 + [Anyone else I should know about?]
     -> other_npcs
 + [Got it. Ready to go]
     -> deployment
 
-=== other_npcs ===
-Agent 0x99: Sarah Martinez is the receptionist. She'll check you in.
+=== deployment_choices ===
++ [Anyone else I should know about?]
+    -> other_npcs
++ [I'll watch for it. Ready to go]
+    -> deployment
 
-Agent 0x99: Be professional. First impressions matter for your cover.
+=== other_npcs ===
+Agent 0x99: Sarah Martinez is the receptionist. Professional, friendly. Don't give her any reason to flag you.
+
+Agent 0x99: And Maya Chen—the journalist who contacted us. Be careful around her. Derek might be watching who she talks to.
 
 -> deployment
 
@@ -270,13 +342,13 @@ Agent 0x99: Be professional. First impressions matter for your cover.
 // ================================================
 
 === deployment ===
-Agent 0x99: Good luck, {player_name}. SAFETYNET is counting on you.
+Agent 0x99: {player_name}, I won't lie. This is bigger than a typical first mission.
 
-Agent 0x99: And remember—technically, you're just an IT contractor doing an audit.
+Agent 0x99: But you're ready. And those 85 people who might die on Sunday? They're counting on you. Even if they don't know it.
 
-Agent 0x99: Keep that cover intact and this should go smoothly.
+Agent 0x99: Stop Operation Shatter. Find the evidence. And make sure Derek Lawson never hurts anyone.
 
 ~ mission_accepted = true
 
-#start_gameplay
+#exit_conversation
 -> END

planning_notes/overall_story_plan/mission_initializations/m01_first_contact/07_ink_scripts/m01_phone_agent0x99.ink

@@ -116,15 +116,15 @@ Agent 0x99: Kevin might have observations about password habits. Check the offic
 === linux_help ===
 ~ linux_hint_given = true
 
-Agent 0x99: Linux systems organize files in directories. Learn to navigate and read files—that's where evidence lives.
+Agent 0x99: Linux navigation basics: ls lists files, cd changes directory, cat reads files.
 
-Agent 0x99: User directories often contain personal files, configurations, and artifacts of their activity.
+Agent 0x99: Check home directories first. User files, personal documents—that's where people hide things.
 
-Agent 0x99: Remember that not everything is visible at first glance. Look deeper.
+Agent 0x99: Not everything is immediately visible. Hidden files start with a dot. Use ls -la to see everything.
 
 + [Where should I look for flags?]
-    Agent 0x99: Think like an investigator. Where would someone store sensitive information? User folders, documents, configuration files.
-    Agent 0x99: Explore systematically. Don't assume you've seen everything in a directory.
+    Agent 0x99: User home directories, document folders, configuration files. Some might be hidden.
+    Agent 0x99: Explore methodically. Each user account might have different evidence.
     -> support_hub
 + [Got it]
     -> support_hub
@@ -138,13 +138,13 @@ Agent 0x99: Remember that not everything is visible at first glance. Look deeper
 
 Agent 0x99: Privilege escalation means gaining access to other user accounts or higher permissions.
 
-Agent 0x99: Linux systems often have permissions that allow certain users to execute commands or access other accounts.
+Agent 0x99: Try sudo -l to see what permissions your current account has. Some accounts can run commands as other users.
 
-Agent 0x99: Investigate what capabilities your current account has. Some accounts can switch to others.
+Agent 0x99: If you can switch users, use sudo -u username bash to get a shell as that user.
 
-+ [What if I don't have special access?]
-    Agent 0x99: Then you'll need to find credentials for other accounts or discover misconfigurations.
-    Agent 0x99: For this mission, there should be a path forward. Look for it.
++ [What if I don't have sudo access?]
+    Agent 0x99: Then look for other credentials, shared passwords, or system misconfigurations.
+    Agent 0x99: But for this environment, there should be a sudo path available.
     -> support_hub
 + [Thanks]
     -> support_hub
@@ -230,6 +230,37 @@ Agent 0x99: Be thorough. Evidence can hide in unexpected places.
     #exit_conversation
     -> support_hub
 
+// ================================================
+// EVENT: CONTINGENCY DISCOVERED (Kevin Frame-Up)
+// ================================================
+
+=== event_contingency_found ===
+#speaker:agent_0x99
+
+Agent 0x99: {player_name}, what did you just find?
+
+Agent 0x99: A contingency plan to frame Kevin? That's... that's despicable.
+
+Agent 0x99: Kevin's been helping you. He's innocent. And Derek's prepared to destroy his life if things go wrong.
+
++ [Can we stop it?]
+    Agent 0x99: You're the one in the field. Depends on what you do with this information.
+    Agent 0x99: You could warn Kevin directly, leave evidence for investigators, or... focus on the primary mission.
+    Agent 0x99: I can't tell you what's right here. That's your call.
+    #exit_conversation
+    -> support_hub
++ [What should I do?]
+    Agent 0x99: I suspected Derek might have failsafes, but I didn't know about this specifically.
+    Agent 0x99: Kevin's fate is in your hands now. Whatever you decide, document that contingency plan.
+    Agent 0x99: We need proof of what Derek was willing to do to innocent people.
+    #exit_conversation
+    -> support_hub
++ [This changes things]
+    Agent 0x99: It does. Kevin trusted you. You have to decide if you can protect him while completing the mission.
+    Agent 0x99: No easy answers here, {player_name}.
+    #exit_conversation
+    -> support_hub
+
 // ================================================
 // EVENT: ALL FLAGS SUBMITTED
 // ================================================

scenarios/m01_first_contact/ink/INTEL_THREADS_SUMMARY.md

@@ -10,16 +10,20 @@ This document outlines how incomplete intel from NPCs leads to evidence discover
 ### Old Approach (Problematic)
 - Agent 0x99 gave exact command syntax (e.g., `hydra -l username -P passwordlist.txt ssh://target`)
 - Maya revealed Derek's office code directly (0419)
-- Kevin stated "Derek uses his birthday in passwords"
+- Kevin stated "Derek uses his birthday in passwords - April 19th, 0419"
+- Agent 0x99 explained Kevin's frame-up contingency in detail
 - All evidence locations explicitly stated
 - Complete tactical walkthrough provided
 
-### New Approach (Discovery-Based)
-- NPCs provide **hints and fragments** that point toward evidence
-- Players must **explore, observe, and correlate** information
-- Multiple sources provide pieces of the puzzle
-- Technical knowledge must be **discovered or researched**
-- Evidence locations hinted at, not explicitly stated
+### New Approach (Balanced Discovery)
+- **Basic technical commands provided** (ls, cd, cat, ls -la, sudo -l, sudo -u)
+  - Players aren't expected to know Linux basics
+  - Commands are tools, discovery is in application
+- **Investigation requires correlation** (Kevin hints at "important dates" → player finds calendar → discovers 0419)
+- **Major discoveries belong to player** (Kevin's frame-up is found, not explained)
+- **Handler has suspicions, not omniscience** ("Derek might have contingencies" → player discovers what they are)
+- **Multiple sources provide puzzle pieces** that must be assembled
+- **Evidence locations hinted at**, not explicitly stated
 
 ---
 
@@ -102,28 +106,30 @@ This document outlines how incomplete intel from NPCs leads to evidence discover
 
 ### Evidence Trail
 
-#### Fragment 1: Agent 0x99 - General Concepts
+#### Fragment 1: Agent 0x99 - Basic Commands
 **Location:** Phone support
 **Intel Provided:**
-- "User directories contain personal files, configurations"
-- "Not everything is visible at first glance. Look deeper"
-- "Think like an investigator. Where would someone hide information?"
+- "ls lists files, cd changes directory, cat reads files"
+- "Check home directories first. User files, personal documents"
+- "Hidden files start with a dot. Use ls -la to see everything"
 
-**What Player Learns:** Hidden files exist, user directories important, need to look carefully.
+**What Player Learns:** Basic Linux commands and that hidden files exist.
 
-#### Fragment 2: VM Environment - Discovery
+#### Fragment 2: VM Environment - Application
 **Location:** Linux VMs in server room
 **Intel Provided:**
 - Directory structure to explore
 - Hidden files (dotfiles) containing flags/evidence
+- Multiple user accounts with different evidence
 
-**What Player Learns:** Specific commands (`ls -la`) and locations through experimentation.
+**What Player Learns:** Where to apply commands, which directories have evidence.
 
-#### Fragment 3: Research/Experimentation
+#### Fragment 3: Investigation & Discovery
 **Action Required:** Player must:
-1. Learn basic Linux commands (ls, cd, cat) through experimentation or research
-2. Discover hidden files concept
-3. Explore methodically to find flags
+1. Navigate to home directories using cd
+2. Use ls -la to reveal hidden files
+3. Read files with cat to find flags
+4. Explore multiple user accounts methodically
 
 **Evidence Unlocked:** Flags in user directories, .bashrc files, hidden config files
 
@@ -133,29 +139,30 @@ This document outlines how incomplete intel from NPCs leads to evidence discover
 
 ### Evidence Trail
 
-#### Fragment 1: Agent 0x99 - General Concept
+#### Fragment 1: Agent 0x99 - Sudo Commands
 **Location:** Phone support
 **Intel Provided:**
-- "Privilege escalation means gaining access to other accounts"
-- "Linux systems have permissions allowing users to execute commands or access other accounts"
-- "Investigate what capabilities your current account has"
+- "Try sudo -l to see what permissions your current account has"
+- "If you can switch users, use sudo -u username bash"
+- "For this environment, there should be a sudo path available"
 
-**What Player Learns:** Concept exists, need to investigate current account permissions.
+**What Player Learns:** Specific sudo commands to use.
 
-#### Fragment 2: VM Environment - Discovery
+#### Fragment 2: VM Environment - Application
 **Location:** Linux VMs
 **Intel Provided:**
-- `sudo -l` command results showing permissions
-- Ability to switch users
+- `sudo -l` results showing which users can be accessed
+- Multiple user accounts to switch between
+- Different evidence in different user accounts
 
-**What Player Learns:** Specific commands and techniques through experimentation.
+**What Player Learns:** Which users exist, which can be accessed, how to apply commands.
 
-#### Fragment 3: Research/Experimentation
+#### Fragment 3: Execution & Discovery
 **Action Required:** Player must:
-1. Learn about sudo command
-2. Discover `sudo -l` to check permissions
-3. Learn `sudo -u username bash` syntax
-4. Execute privilege escalation
+1. Run `sudo -l` on initial account
+2. Identify which users can be accessed
+3. Use `sudo -u username bash` to switch users
+4. Explore each user's home directory for evidence
 
 **Evidence Unlocked:** Additional user accounts, higher-level flags, sensitive files
 
@@ -219,39 +226,51 @@ This document outlines how incomplete intel from NPCs leads to evidence discover
 
 ### Evidence Trail
 
-#### Fragment 1: Maya (NPC) - Concern About Derek
+#### Fragment 1: Agent 0x99 (Opening Briefing) - Vague Warning
+**Location:** Mission briefing (if player asks for specific advice)
+**Intel Provided:**
+- "Derek's meticulous. If he's planning something this big, he'll have contingencies"
+- "Failsafes, scapegoats, ways to cover his tracks if things go wrong"
+- "Derek might have plans that put innocent people at risk"
+
+**What Player Learns:** Derek might target innocent people, but specifics unknown.
+
+#### Fragment 2: Maya (NPC) - Concern About Derek
 **Location:** Office conversation
 **Intel Provided:**
 - Derek is "paranoid" and defensive
 - "Sometimes I wonder if he's involved in something bigger"
 
-**What Player Learns:** Derek may have backup plans.
+**What Player Learns:** Derek may have backup plans, reinforces suspicion.
 
-#### Fragment 2: Derek's Computer Files
+#### Fragment 3: Derek's Computer Files (Discovery!)
 **Location:** Derek's office computer (after gaining access)
 **Intel Provided:**
 - "Contingency_Plan.txt" or similar file
 - Documents showing plan to frame Kevin
-- Forged logs and emails
+- Forged logs, fake evidence, frame-up timeline
 
-**What Player Learns:** Derek plans to frame Kevin if discovered.
+**What Player Learns:** Derek plans to frame Kevin if discovered - player discovers this themselves!
 
-#### Fragment 3: Agent 0x99 Reaction (Event-Triggered)
-**Location:** Phone call after discovering contingency
+#### Fragment 4: Agent 0x99 Reaction (Event-Triggered)
+**Location:** Phone call after player discovers contingency
 **Intel Provided:**
-- Explains what the contingency means for Kevin
-- Presents player with choices (warn Kevin, plant evidence, ignore)
+- "I suspected Derek might have failsafes, but I didn't know about this specifically"
+- Reacts with shock and disgust at the discovery
+- "Kevin's fate is in your hands now"
+- Leaves decision to player (no prescriptive advice)
 
-**What Player Learns:** Moral implications and response options.
+**What Player Learns:** This is player's discovery, handler didn't know. Player must decide what to do.
 
-#### Fragment 4: Correlation
+#### Fragment 5: Player Choice
 **Action Required:** Player must:
-1. Gain access to Derek's computer
-2. Read contingency files
-3. Understand implications
-4. Make choice about Kevin's fate
+1. Hear vague warning from Agent 0x99 in briefing (optional)
+2. Gain access to Derek's computer
+3. Discover and read contingency files
+4. Report discovery to Agent 0x99 (triggers event)
+5. Make moral choice: warn Kevin, leave evidence, or focus on mission
 
-**Evidence Unlocked:** Moral choice, narrative branch, Kevin's fate determined
+**Evidence Unlocked:** Moral choice, narrative branch, Kevin's fate determined by player action
 
 ---
 

scenarios/m01_first_contact/ink/m01_opening_briefing.ink

@@ -313,11 +313,23 @@ Agent 0x99: The IT manager—Kevin Park—is your entry point. Build rapport wit
 
 Agent 0x99: He's not ENTROPY, just overworked and underpaid. He'll appreciate competent help and give you access.
 
+Agent 0x99: One thing though—Derek's meticulous. If he's planning something this big, he'll have contingencies.
+
++ [What kind of contingencies?]
+    Agent 0x99: Failsafes, scapegoats, ways to cover his tracks if things go wrong.
+    Agent 0x99: Keep your eyes open. Derek might have plans that put innocent people at risk.
+    -> deployment_choices
 + [Anyone else I should know about?]
     -> other_npcs
 + [Got it. Ready to go]
     -> deployment
 
+=== deployment_choices ===
++ [Anyone else I should know about?]
+    -> other_npcs
++ [I'll watch for it. Ready to go]
+    -> deployment
+
 === other_npcs ===
 Agent 0x99: Sarah Martinez is the receptionist. Professional, friendly. Don't give her any reason to flag you.
 

scenarios/m01_first_contact/ink/m01_phone_agent0x99.ink

@@ -116,15 +116,15 @@ Agent 0x99: Kevin might have observations about password habits. Check the offic
 === linux_help ===
 ~ linux_hint_given = true
 
-Agent 0x99: Linux systems organize files in directories. Learn to navigate and read files—that's where evidence lives.
+Agent 0x99: Linux navigation basics: ls lists files, cd changes directory, cat reads files.
 
-Agent 0x99: User directories often contain personal files, configurations, and artifacts of their activity.
+Agent 0x99: Check home directories first. User files, personal documents—that's where people hide things.
 
-Agent 0x99: Remember that not everything is visible at first glance. Look deeper.
+Agent 0x99: Not everything is immediately visible. Hidden files start with a dot. Use ls -la to see everything.
 
 + [Where should I look for flags?]
-    Agent 0x99: Think like an investigator. Where would someone store sensitive information? User folders, documents, configuration files.
-    Agent 0x99: Explore systematically. Don't assume you've seen everything in a directory.
+    Agent 0x99: User home directories, document folders, configuration files. Some might be hidden.
+    Agent 0x99: Explore methodically. Each user account might have different evidence.
     -> support_hub
 + [Got it]
     -> support_hub
@@ -138,13 +138,13 @@ Agent 0x99: Remember that not everything is visible at first glance. Look deeper
 
 Agent 0x99: Privilege escalation means gaining access to other user accounts or higher permissions.
 
-Agent 0x99: Linux systems often have permissions that allow certain users to execute commands or access other accounts.
+Agent 0x99: Try sudo -l to see what permissions your current account has. Some accounts can run commands as other users.
 
-Agent 0x99: Investigate what capabilities your current account has. Some accounts can switch to others.
+Agent 0x99: If you can switch users, use sudo -u username bash to get a shell as that user.
 
-+ [What if I don't have special access?]
-    Agent 0x99: Then you'll need to find credentials for other accounts or discover misconfigurations.
-    Agent 0x99: For this mission, there should be a path forward. Look for it.
++ [What if I don't have sudo access?]
+    Agent 0x99: Then look for other credentials, shared passwords, or system misconfigurations.
+    Agent 0x99: But for this environment, there should be a sudo path available.
     -> support_hub
 + [Thanks]
     -> support_hub
@@ -230,6 +230,37 @@ Agent 0x99: Be thorough. Evidence can hide in unexpected places.
     #exit_conversation
     -> support_hub
 
+// ================================================
+// EVENT: CONTINGENCY DISCOVERED (Kevin Frame-Up)
+// ================================================
+
+=== event_contingency_found ===
+#speaker:agent_0x99
+
+Agent 0x99: {player_name}, what did you just find?
+
+Agent 0x99: A contingency plan to frame Kevin? That's... that's despicable.
+
+Agent 0x99: Kevin's been helping you. He's innocent. And Derek's prepared to destroy his life if things go wrong.
+
++ [Can we stop it?]
+    Agent 0x99: You're the one in the field. Depends on what you do with this information.
+    Agent 0x99: You could warn Kevin directly, leave evidence for investigators, or... focus on the primary mission.
+    Agent 0x99: I can't tell you what's right here. That's your call.
+    #exit_conversation
+    -> support_hub
++ [What should I do?]
+    Agent 0x99: I suspected Derek might have failsafes, but I didn't know about this specifically.
+    Agent 0x99: Kevin's fate is in your hands now. Whatever you decide, document that contingency plan.
+    Agent 0x99: We need proof of what Derek was willing to do to innocent people.
+    #exit_conversation
+    -> support_hub
++ [This changes things]
+    Agent 0x99: It does. Kevin trusted you. You have to decide if you can protect him while completing the mission.
+    Agent 0x99: No easy answers here, {player_name}.
+    #exit_conversation
+    -> support_hub
+
 // ================================================
 // EVENT: ALL FLAGS SUBMITTED
 // ================================================