Investigate a full disk using evidence from one local workspace. The requesting team needs a diagnosis and a narrow repair, with unrelated records retained. Start by capturing what the terminal shows, then separate the candidate cause from the result you can verify. A plausible note alone does not repair the system. The final answer is checked against the fixture and the earlier evidence remains part of the handoff. Use the same workspace across all five steps. If you change your approach, inspect what your earlier commands left behind before continuing.