How could a Russian test of NATO's resolve in the Baltic unfold?

The CIA director just warned Moscow off the Baltics; the assessed threat is a deniable, sub-Article-5 test aimed at the alliance's unanimity. Rehearsed from the week after the warning.

Updated 2026-09-13 · weekly cadence · N=5 per cycle · world as of Q3 2026 · baltic-resolve v1

Executive summary

Across all five rehearsals, the immediate coercive objective of alliance fracture was not achieved: NATO converged on reversible defense, auditable attribution and fast consultation, although none of the runs had to prove unanimity for kinetic action or an Article 5 response. The operational risk sat beneath that consensus—3/5 runs exposed command, readiness or civilian-handoff defects, while negotiation displaced the declared wargame mechanism in every phase of all five runs.

Key judgments

Outcome landscape

Trajectory

T1–2 · 0–12 h — Immediate posture and process lock-in
Alliance, information and procedural activity begins at T1, while negotiation begins by T2 in every run. Capitals name liaisons, launch readiness measures and seek to define how an ambiguous incident will enter NATO machinery; where explicit escalation occurs, it begins at T1.

T3–6 · 12–36 h — Concessions define the firebreak
Concessions have begun by T3 in all runs. Actors separate immediate protection from attribution and punishment, add national caveats and second-source rules, and begin constructing Russian pause or technical-review arrangements.

T7–11 · 36–66 h — Ambiguity tests attribution and continuity
Every run has introduced pressure by T8, and additional shocks or drills force the new structures to process drone, GPS, rail, cyber or communications ambiguity. The recurrent response is evidence preservation and bounded defensive readiness rather than retaliation.

T12–15 · 66–90 h — Late operational proof and bounded closure
All five runs convert at least part of the protocol stack into an operational or simulated validation. End states preserve defensive authority and off-ramps, but divide between successful validation, residual readiness defects and closure without a live trigger.

Indicators to watch

• Allied capitals register empowered NAC duty officers, alternates and 24/7 secure endpoints, then conduct unscheduled reachability tests.
• NAC or national orders pre-authorize temporary air surveillance, counter-drone, cyber and force-protection measures while reserving sanctions and Article 5 decisions.
• Governments or media launch timestamped evidence ledgers with confidence grades, chain-of-custody identifiers and correction deadlines.
• Russia proposes a time-bounded transponder, aviation, maritime, GPS or cyber pause tied to named liaisons and technical-data exchanges.
• Suwałki or Baltic exercises shift from tabletop activity to no-notice drills involving degraded GPS, loss of a primary link and civilian rail or port reception.
• Operational logs show missed 15–30 minute acknowledgments, incomplete source-log custody attestations or late civilian handoffs.
• Emergency readiness moves or intelligence leaks appear before allied attribution has reached its validation threshold.

Limitations

The only named documentary anchors were the Wall Street Journal report of the August 6 U.S. intelligence assessment and the July 30 letter to Brussels signed by Kallas, Kubilius and Dombrovskis, supplemented by cited official statements and open reporting on the Ratcliffe–Naryshkin meeting and Baltic incidents. No separate evidence_base or underlying assessment, letter text, meeting record, or forensic and sensor data for the Leipzig drones, GPS jamming, seabed cables and border incidents was supplied; the runs were therefore ungrounded beyond the authored premise package. The campaign also supplied no force-stock, attrition, air-defense magazine or detailed Russian order-of-battle data, and institutional vote counts varied between 29 and 32, so it did not validate sustained combat or exact NAC mechanics. Findings F3 and F4 should be retested against actual diplomatic and technical records, and F6 against measured readiness, logistics and communications data. Background reality was grounded in world snapshot 2026Q3.

How to read this

Built by multi-run agent rehearsal (Endgame Simulations): the same scenario rehearsed 5 times, world as of Q3 2026, generated 2026-09-13. Frequencies are shares of rehearsals ending in each outcome under the stated scenario assumptions and world grounding. They are exploration of plausible dynamics, not forecasts of real-world events.

Machine twin: baltic-resolve.json · citation: Endgame Simulations rehearsal distribution — baltic-resolve v1, world as of Q3 2026, N=5, generated 2026-09-13. Not a forecast.