This document defines the canonical structure of a Case File (CASE-type document). All anomalous case documentation conforms to the format specified here. A case file comprises a document reference, a structured Header block, an optional Warning, and five required content sections. The full catalogue of Bureau document templates is maintained in DOC-000-02.

A case file is identified as CASE-XXXX-"CODENAME", where XXXX is the four-digit sequential identifier assigned at registration and CODENAME is the all-caps case codename in double quotes (Compendium §7). The identifier is fixed at registration and does not change. Sub-instances of a case take a suffix per Compendium §7: a numeric suffix for enumerated instances (CASE-XXXX-1), a Greek lowercase suffix for categorically distinct instances (CASE-XXXX-α).

The Header is a structured field block, not prose. Fields appear in the following order:

Document Reference:      CASE-XXXX-"CODENAME"
Control Code-Modifiers:  [code, with optional /-joined modifiers]
Hazard Types:            [hazard codes, /-joined]
Hazard Modifier:         [PENDING | NEUTRALIZED | MUNDANE | THEORETICAL]
Protocol:                [WHITE HORSE | RED HORSE | BLACK HORSE | PALE HORSE]
Lead Investigator:       <Name or Redaction> / BAR-{DIV}-{NNNNN}
Security Clearance:      Level [1–5 or Ω]
Last Reviewed:           YYYY-MM-DD

All fields are required except Hazard Modifier, which is included only when an exceptional modifier applies and may alternatively be expressed inline within Hazard Types (e.g., C/P-PENDING). The Control Code, Hazard, and Protocol classifications are specified in Compendium §8; Protocol is computed from the hazard weight matrix and entered explicitly, with (OVERRIDE) appended and justification recorded in Containment Protocol where the assignment is set manually.

The Warning is the only optional section, and appears above the Header when present. It is used where the reader must be alerted before engaging with the case content — impostor or memetic hazards, or an active directive constraining how the case is handled. It carries a short all-caps title and one or two paragraphs of operational instruction. It is not added to ordinary cases; overuse degrades its signal value across the corpus.

Five sections follow the Header, in order. All are required; where a section has no substantive content yet, the heading is retained with a brief placeholder statement rather than omitted.

1. Containment Protocol — how the anomaly is contained, what measures personnel observe, and what conditions trigger response. Procedural-imperative voice.
2. Phenomenological Summary — the anomaly's characteristics, observed effects, and known constraints. Clinical-observational voice; behavioural language ("behaviour consistent with hunger") over psychological.
3. Notes & Observations — dated, attributed entries, each under a ### YYYY-MM-DD — Title — Attribution heading, revealing the case's development over time.
4. Discovery Log — how the anomaly came to Bureau attention. The only section in which narrative latitude is permitted.
5. Incident Logs — dated incident entries, each under a ### YYYY-MM-DD — Incident CASE-XXXX-N: Title heading. An incident earns an entry when it teaches something new.

Canonical elements are referenced in case prose by their standard inline forms: Protocol PR-400-73 "BLACK HORSE"; Cover Story CC-XXXX-YY; ARU "CODENAME"; Form REQ-300-03; Directive DX-300-01; an anomalous effect by its catalogue entry (REP-600-11, Entry 47). Removed content is marked with the redaction glyph █ or the [REDACTED] token.