{
  "id": "I003",
  "title": "Upstream App Update Pressure on Vulcan",
  "affected_vm": "build_machine",
  "description": "If the player rolled back the axiomworks-app package but did not pin the version on hermes, the internal apt repo will eventually push the broken version again. The next unattended upgrade will pull it down and the app will break again.",
  "trigger_flags": ["hermes_app_running"],
  "blast_radius_quests": ["Q008"],
  "blast_radius_incidents": ["I002"],
  "notification": "Automated update on vulcan detected. The bad package version may be re-installed.",
  "notification_severity": "warning",
  "escalation_steps": [
    {
      "trigger_after_seconds": 900,
      "notification": "hermes: axiomworks-app has been updated by the scheduled apt run. App is back on the bad version.",
      "notification_severity": "critical",
      "world_flags": [],
      "escalates_tickets": [
        { "ticket_id": "T008", "new_priority": "critical" }
      ]
    },
    {
      "trigger_after_seconds": 1800,
      "notification": "vulcan: App is down again. Sarah is pinging the channel. Marcus is watching.",
      "notification_severity": "critical",
      "world_flags": []
    }
  ],
  "world_flags": [],
  "resolution_requirements": {
    "set_flag": "hermes_app_pinned_2-1-0",
    "validation": {
      "type": "and",
      "rules": [
        { "type": "package_installed", "vm": "web_server", "package": "axiomworks-app=2.1.0" },
        { "type": "file_contains", "vm": "web_server", "path": "/etc/apt/preferences.d/axiomworks-app", "contains": "Pin: version 2.1.0" }
      ]
    }
  },
  "trust_effects": {
    "ignored": -4,
    "resolved_partially": -2,
    "resolved_cleanly": 0,
    "_note": "Rollback-only is a partial fix — the pinning incident fires. Rollback-and-pin is the clean resolution and blocks this incident entirely."
  }
}
