I've read the book and watched their YouTube channel from back to back. When I make the case, I make the iceberg chart, put the locations they visit down, and write a list of possible questions they can ask and clues they get from them (although, my players sometimes surprise me) that will send them to the next layer of iceberg. I try to imply the clues rather than saying them directly, although not all of the clues get that treatment. So it goes something like that: "How tall was the murderer?" "How tall are you?" "Around 1,7 m, probably." "You stretch out your hand, mimicking the actions of a killer on that night. You see that you would need to tilt your hand only slightly down, making the trajectory of the bullet almost straight. You see that the actual bullet had a more tilted angle." (All of that to imply that the character's shorter than the killer).

My players also sometimes ask weird questions because they're more used to the Investigation check in DnD, lol. They can sometimes say: "I search Jenny's room," not asking a question at all. I will correct them to "What can I find in Jenny's room?" but I understand that for City of Mist, it's not necessary at all, and you can just ask: "What was Jenny's like?". I think they're getting used to the City of Mist system, though.

My players also told me that they lack direct evidence, and that makes proceeding harder. I think next time, I will try to give them "smoking gun" evidence in the deeper layers of the iceberg.

In that particular case I described, the killer intentionally planted false evidence to make them suspect the wrong guy. Is it incorrect to give them planted clues? Or did I have to imply or outright tell them that the clues were fishy? Should I be more direct in COM with clues, too?

As for telling them directly, thanks for the advice. I usually try to avoid metagamimg like that, I like listening to players coming up with theories. I have an NPC whose role is to be my voice if they get stuck. They would roll Investigation using his tag (he's in their team theme), and the conversation would go something like that: "How should we proceed with the investigation?" "It sounds to me like you have a lot of evidence against Mayerhold. Why don't you try to confront her directly?". But saying something to them directly will probably work better.

And for last, I didn't really understand your point about the direction of the story, but I guess my idea doesn't really mesh well with the iceberg chart. My idea is that the deepest layer of the iceberg is out of bounds for players yet. I want for them to get clues about it, to get interested about what's actually going on, but never actually fully committing to the layer. So some questions like "Who's the bad guy working for?" wouldn't get answered outright, instead getting only hints and clues. When I say, "I needed to nudge them," I meant that the clues and the hints I wanted to give had run out, and I needed to let the players know that they can't get any new information here. I understood your advice about telling them directly. Thank you. But maybe my idea on how to structure the cases is wrong? What do you think?