{
  "id": "marcus-Q005",
  "character": "marcus",
  "quest_id": "Q005",
  "series_id": "marcus-main",
  "series_position": 5,
  "messages": [
    {
      "stage": "intro",
      "trigger": "quest_activated",
      "body": "Dave's disk alert is on /var/backups this time, not /var/log. That's a different problem. Something to do with the backup job probably."
    },
    {
      "stage": "hint_1",
      "trigger": "player_requested_help",
      "body": "Look at what owns the files in that directory. If it's root and the backup agent is supposed to manage them, someone ran something as the wrong user."
    },
    {
      "stage": "hint_2",
      "trigger": "player_requested_help_again",
      "body": "Check /etc/cron.d/. Jobs in there can specify a user on the line. If there's no user field it defaults to root."
    },
    {
      "stage": "hint_3",
      "trigger": "player_requested_help_again",
      "body": "The line format is: schedule user command. If yours is just: schedule command — that's the problem. Add the user field."
    },
    {
      "stage": "complete-clean",
      "trigger": "world_flag:hermes_backup_healthy",
      "body": "Good catch on the ownership cleanup too. A lot of people would have just fixed the cron line and left the old root-owned files sitting there."
    },
    {
      "stage": "complete-partial",
      "trigger": "world_flag:hermes_backup_partial",
      "body": "Cron's correct now. The old files are still owned by root though — the retention script won't be able to clean them up. Worth sorting that out before the disk fills again."
    },
    {
      "stage": "complete-wrong",
      "trigger": "world_flag:hermes_backup_root_running",
      "body": "Disk's clear. But what was actually running that job? If root is still running it that directory is going to fill up again."
    }
  ]
}