The tutorial
Eleven guided steps on night one, taught with real incidents running slowly.
Last updated:
Night one of the campaign is guided. A senior sysadmin called Deniz talks you through it, and her lines arrive in the log stream like everything else — there is no separate tutorial interface, because breaking terminal integrity to teach the terminal would be a strange trade.
The eleven steps
| Step | What it does | |
|---|---|---|
| 1 | welcome | Sets the scene |
| 2 | ask_status | Has you run status |
| 3 | explain_screen | Walks through the rack, the meters and the log stream |
| 4 | leak_intro | Injects a real memory leak; teaches top |
| 5 | leak_fix | Waits for the incident to be resolved |
| 6 | leak_done | Confirms what happened |
| 7 | ddos_intro | Injects a real flood; teaches netstat |
| 8 | ddos_fix | Guides the response, including CIDR notation |
| 9 | ddos_done | Confirms |
| 10 | help_intro | Shows help and man |
| 11 | wrap_up | Ends the shift early and introduces the report screen |
It teaches with real incidents
The two incidents in the tutorial are the actual memory leak and flood definitions, not simplified stand-ins. What changes is speed: the leak runs at half rate and the flood at a third, giving you room to read.
That matters because the reflex transfers exactly. What you learn on night one is the same incident you will meet on night six — just with less time.
It waits for the outcome, not the keystroke
Step 5 waits for the leak to be resolved, not for one specific command. If there is more than one legitimate way to deal with it, all of them satisfy the step. The tutorial checks that the world got better, which is the same thing the rest of the game checks.
Skipping
Type skip at any point and the tutorial ends. It prints two lines on its way
out, reminding you that help exists.
A game saved mid-tutorial resumes at the step you were on. Saves made before this was added simply open with guidance switched off.